4 ms·

Sorry to ask for a source, but is that actually true? I'm pretty sure they are covered. I would be interested in opening an account and filing a complaint again

Sorry to ask for a source, but is that actually true? I'm pretty sure they are covered. I would be interested in opening an account and filing a complaint against them if they aren't treating PII or PHI in a compliant manner.

SkyPuncher 4y ago
Put simply, HIPAA only applies to insurance based transactions.
- JohnFen 4y ago
  This is not accurate. That's its main purpose, but it covers more than just that. https://www.cdc.gov/phlp/publications/topic/hipaa.html https://www.cdc.gov/phlp/publications/topic/hipaa.html
  - SkyPuncher 4y ago
    It's not fully accurate, but it's accurate enough for lay people. I founded a HealthTech company. I'm very familiar with the rules. The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"
    - JohnFen 4y ago
      Ah, I understand. Thank you. That explains the existence of several troubling loopholes I've seen.
      - SkyPuncher 4y ago
        Yep. We actually got multiple legal opinions on this. I was coming in from outside healthcare and absolutely baffled how little HIPAA applies to.
        JohnFen 4y ago
        My wife is a nurse, and she once made a comment that alluded to this. She said that where HIPAA applies, it applies very strongly. That's why hospital staff, for instance, are always extremely careful about not violating HIPAA. But, she said, it doesn't apply everywhere. Her example was with drug and medical appliance companies who use patient data for marketing purposes.
        SkyPuncher 4y ago
        Yep, if you’re a covered entity, you want to make sure you get things eighth. Punishments for being wrong can be very severe. Many organizations will use an abundance of caution and treat far more than necessary as HIPAA-controlled simply because it’s less risky.
- dragonwriter 4y ago
  > Put simply, HIPAA only applies to insurance based transactions. That’s not true. (Following explanation has been edited significantly to accurately describe how HIPAA applies beyond insurance transactions; original was overly broad.) HIPAA was centrally about insurance (it is the “Health Insurance Portability and Accountability Act”), and only covers providers who conduct certain insurance-related transactions electronically, but the privacy positions apply to conduct by those covered healthcare providers generally as well as the whole chain of insurance transactions connected to them (not just to the content of covered insurance transactions, or patients involved in those transactions), it was put in the bill to address concerns with the standardization and promotion of electronic transactions and standard identifiers for insurance transactions, which critics feared would result in a health care privacy apocalypse, but it applies beyond the scope of the insurance transactions.
  - SkyPuncher 4y ago
    I will die on this hill. I ran a HealthTech company and we spent extensive time and legal counsel understanding our HIPAA obligations. For example, if a provider is cash-only, they are not bound by HIPAA. ---- It's really important to see the nuance in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > This includes providers such as: > Doctors > Clinics > Psychologists > Dentists > Chiropractors > Nursing Homes > Pharmacies > *...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.* Emphasis mine. That last sentence is the big "gotcha" on who HIPAA applies to.
    - dragonwriter 4y ago
      You are correct that HIPAA only applies to entities who engage in insurance-related transactions, and that a cash-only provider would not be bound by it, and you are right to point this out as an important limitation. At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.
jjeaff 4y ago
The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don't think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it. "Covered entities" and usually just the medical companies, insurance companies, and some governmental agencies when it comes to HIPPA.
- dragonwriter 4y ago
  > The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don’t think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it. If a covered entity is using it to gather and return PHI from/to clients then either (1) the service provider must be a business associated (and is, therefore, covered by HIPAA), or (2) any PHI must pass over the service provider’s encrypted and inaccessible to the service provider, and every time that doesn’t occur is a privacy breach. But both this article and the FTC page on the settlement make it sound like BetterHelp is a provider [0], not an intermediary (note that them being subject to FTC jurisdiction because of violation of their published privacy policy, etc., does not mean that they would not also be subject to HHS jurisdiction for HIPAA violations.) [0] From the FTC page: “California-based BetterHelp offers online counseling services under several names, including BetterHelp Counseling”
- pyuser583 4y ago
  There are two different types of covered entities - providers, and those providing services to providers.

SkyPuncher 4y ago

Put simply, HIPAA only applies to insurance based transactions.

JohnFen 4y ago
This is not accurate. That's its main purpose, but it covers more than just that. https://www.cdc.gov/phlp/publications/topic/hipaa.html https://www.cdc.gov/phlp/publications/topic/hipaa.html
- SkyPuncher 4y ago
  It's not fully accurate, but it's accurate enough for lay people. I founded a HealthTech company. I'm very familiar with the rules. The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"
  - JohnFen 4y ago
    Ah, I understand. Thank you. That explains the existence of several troubling loopholes I've seen.
    - SkyPuncher 4y ago
      Yep. We actually got multiple legal opinions on this. I was coming in from outside healthcare and absolutely baffled how little HIPAA applies to.
      - JohnFen 4y ago
        My wife is a nurse, and she once made a comment that alluded to this. She said that where HIPAA applies, it applies very strongly. That's why hospital staff, for instance, are always extremely careful about not violating HIPAA. But, she said, it doesn't apply everywhere. Her example was with drug and medical appliance companies who use patient data for marketing purposes.
        SkyPuncher 4y ago
        Yep, if you’re a covered entity, you want to make sure you get things eighth. Punishments for being wrong can be very severe. Many organizations will use an abundance of caution and treat far more than necessary as HIPAA-controlled simply because it’s less risky.
dragonwriter 4y ago
> Put simply, HIPAA only applies to insurance based transactions. That’s not true. (Following explanation has been edited significantly to accurately describe how HIPAA applies beyond insurance transactions; original was overly broad.) HIPAA was centrally about insurance (it is the “Health Insurance Portability and Accountability Act”), and only covers providers who conduct certain insurance-related transactions electronically, but the privacy positions apply to conduct by those covered healthcare providers generally as well as the whole chain of insurance transactions connected to them (not just to the content of covered insurance transactions, or patients involved in those transactions), it was put in the bill to address concerns with the standardization and promotion of electronic transactions and standard identifiers for insurance transactions, which critics feared would result in a health care privacy apocalypse, but it applies beyond the scope of the insurance transactions.
- SkyPuncher 4y ago
  I will die on this hill. I ran a HealthTech company and we spent extensive time and legal counsel understanding our HIPAA obligations. For example, if a provider is cash-only, they are not bound by HIPAA. ---- It's really important to see the nuance in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > This includes providers such as: > Doctors > Clinics > Psychologists > Dentists > Chiropractors > Nursing Homes > Pharmacies > *...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.* Emphasis mine. That last sentence is the big "gotcha" on who HIPAA applies to.
  - dragonwriter 4y ago
    You are correct that HIPAA only applies to entities who engage in insurance-related transactions, and that a cash-only provider would not be bound by it, and you are right to point this out as an important limitation. At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

jjeaff 4y ago

The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don't think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it. "Covered entities" and usually just the medical companies, insurance companies, and some governmental agencies when it comes to HIPPA.

dragonwriter 4y ago
> The psychologists/therapists themselves would always be bound by HIPPA, from what I understand. But I don’t think that a service like BetterHelp would be bound any more than google calendar would be bound by HIPPA just because doctors are using it. If a covered entity is using it to gather and return PHI from/to clients then either (1) the service provider must be a business associated (and is, therefore, covered by HIPAA), or (2) any PHI must pass over the service provider’s encrypted and inaccessible to the service provider, and every time that doesn’t occur is a privacy breach. But both this article and the FTC page on the settlement make it sound like BetterHelp is a provider [0], not an intermediary (note that them being subject to FTC jurisdiction because of violation of their published privacy policy, etc., does not mean that they would not also be subject to HHS jurisdiction for HIPAA violations.) [0] From the FTC page: “California-based BetterHelp offers online counseling services under several names, including BetterHelp Counseling”
pyuser583 4y ago
There are two different types of covered entities - providers, and those providing services to providers.