6 ms·
Why doesn't this breach constitute some sort of HIPAA violation? I.e. exposure of personally identifiable information
by syndicatedjelly 3y ago
Why doesn't this breach constitute some sort of HIPAA violation? I.e. exposure of personally identifiable information
- thfuran 3y agohttps://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- syndicatedjelly 3y agoReading that table, it sounds like 23AndMe should be classified as a Health Care Clearinghouse. I'm assuming they send samples to a lab for processing, and then convert those results into a standardized data format.
- thfuran 3y agoNo, the clearinghouses are middlemen between healthcare providers and health plans. They are a covered entity who deals in processing data for and from other covered entities. I don't think 23andme fits any of the bins. They're just a non-healthcare-related company that ends up with data that would otherwise have only been available to healthcare providers (and the other covered entities they deal with).
- syndicatedjelly 3y agoI see. Sounds like HIPAA was written for a world that no longer exists.
- thfuran 3y agoIt was written with a narrow focus on regulating the healthcare system rather than explicitly and comprehensively protecting a class of data, so it just wasn't meant to impose any restriction on every other party a person might disclose medical information to.