3 ms·
Absolutely right call. How can any company officer actually believe this was an acceptable business practice. Being in that business they must have heard of H
by mc32 4y ago
Absolutely right call. How can any company officer actually believe this was an acceptable business practice. Being in that business they must have heard of HIPAA and regulation around PHI. What would keep hospitals from selling patient info?
- lp0_on_fire 4y ago> How can any company officer actually believe this was an acceptable business practice. Because the penalty is small enough that it's a "cost of doing business". Until these fines are large enough to cause hardship to the company, or we start piercing the corporate veil and go after executives in their personal capacity this is going to keep happening. I simply do not believe there is a good-faith argument that GoodRX wasn't familiar with the law in this case.
- SkyPuncher 4y agoOnly covered entities are bound by HIPAA: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... Notably: > [a bunch of providers] ...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. If you don't process a specific type of transaction, no HIPAA requirements.
- ThaDood 4y agoAlso if a CE enters into a BA with some company, AFAIK, data sharing can basically occurs without issue and still maintaining compliance since patient consent to data sharing occurs with the CEs.