5 ms·

Would make for an interesting lawsuit. Should chrome be held liable for violating hipaa.

thaeli 4y ago
I don't see how they would be a covered entity.
tomrod 4y ago
Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]

I don't see how they would be a covered entity.

Yes, as well as other browsers. I have doubts it would win, however, as identifying PHI has several safe harbor clauses (such as unidentifiable at the ZIP2/ZIP3 level, etc.). IP addresses haven't been precise for a long time, to my understanding? (not my area). https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act https://en.wikipedia.org/wiki/Health_Insurance_Portability_a... > An individual who believes that the Privacy Rule is not being upheld can file a complaint with the Department of Health and Human Services Office for Civil Rights (OCR).[37][38] In 2006 the Wall Street Journal reported that the OCR had a long backlog and ignores most complaints. "Complaints of privacy violations have been piling up at the Department of Health and Human Services. Between April of 2003 and November 2006, the agency fielded 23,886 complaints related to medical-privacy rules, but it has not yet taken any enforcement actions against hospitals, doctors, insurers or anyone else for rule violations. A spokesman for the agency says it has closed three-quarters of the complaints, typically because it found no violation or after it provided informal guidance to the parties involved."[39] However, in July 2011, the University of California, Los Angeles agreed to pay $865,500 in a settlement regarding potential HIPAA violations. An HHS Office for Civil Rights investigation showed that from 2005 to 2008, unauthorized employees repeatedly and without legitimate cause looked at the electronic protected health information of numerous UCLAHS patients.[40] > It is a misconception that the Privacy Rule creates a right for any individual to refuse to disclose any health information (such as chronic conditions or immunization records) if requested by an employer or business. HIPAA Privacy Rule requirements merely place restrictions on disclosure by covered entities and their business associates without the consent of the individual whose records are being requested; they do not place any restrictions upon requesting health information directly from the subject of that information.[41][42][43]