2 ms·
It's not fully accurate, but it's accurate enough for lay people. I founded a HealthTech company. I'm very familiar with the rules. The key here is in the defi
by SkyPuncher 4y ago
It's not fully accurate, but it's accurate enough for lay people. I founded a HealthTech company. I'm very familiar with the rules.
The key here is in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
> [list of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.
In grossly simple terms, that means if insurance/medicare/medicaid is not involved, it's not a "transaction for which HHS has adopted a standard"
- JohnFen 4y agoAh, I understand. Thank you. That explains the existence of several troubling loopholes I've seen.
- SkyPuncher 4y agoYep. We actually got multiple legal opinions on this. I was coming in from outside healthcare and absolutely baffled how little HIPAA applies to.
- JohnFen 4y agoMy wife is a nurse, and she once made a comment that alluded to this. She said that where HIPAA applies, it applies very strongly. That's why hospital staff, for instance, are always extremely careful about not violating HIPAA. But, she said, it doesn't apply everywhere. Her example was with drug and medical appliance companies who use patient data for marketing purposes.
- SkyPuncher 4y agoYep, if you’re a covered entity, you want to make sure you get things eighth. Punishments for being wrong can be very severe. Many organizations will use an abundance of caution and treat far more than necessary as HIPAA-controlled simply because it’s less risky.