3 ms·

> Most companies that process health information in the US need to become HIPAA compliant I appreciated what Delve is doing for these kind of companies but wha

> Most companies that process health information in the US need to become HIPAA compliant I appreciated what Delve is doing for these kind of companies but what about non-tech small companies & individual therapists that process health data? We enlist the services of multiple behavioral / mental health providers and most of them use personal devices / SMS / GMail for transmitting PHI[1]. I understand this may not be the target audience for Delve but getting these kind of companies HIPAA-compliant is a real need. [1] https://www.hhs.gov/answers/hipaa/what-is-phi/index.html https://www.hhs.gov/answers/hipaa/what-is-phi/index.html

selinkocalar 3y ago
It's an interesting point you raise. You're correct in that our current target audience primarily covers the companies that provide services to healthcare providers instead of actual healthcare providers. For more context, HIPAA breaks companies into two categories: (1) Covered Entities, which are healthcare providers, health plans, and healthcare clearinghouses, and (2) Business Associates, which are companies that process PHI on behalf of Covered Entities. Behavioral/mental health providers fall into the Covered Entity category, and their requirements under HIPAA are different than those of Business Associates. Our services are currently focused on supporting Business Associate needs.
- fhsm 3y ago
  > … providers fall into the Covered Entity category … If doctor etc is a Covered Entity then that doctor is most likely a Provider, but is every doctor providing healthcare a really CE? I wouldn’t have said no but I don’t track it ultra closely so I’m curious what’s the latest? My first three results matched my expectation but they could easily be out of date… https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-covered-entity-if-you-dont-bill-electronically/ https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-co... https://www.stevenslee.com/health-law-observer-blog/is-a-cash-only-medical-practice-subject-to-hipaa/ https://www.stevenslee.com/health-law-observer-blog/is-a-cas... https://www.americares.org/wp-content/uploads/globalassets/_snc/eduresources/practicefacility/hipaa/2.-hipaa-faqs-may-2014.pdf https://www.americares.org/wp-content/uploads/globalassets/_... Anyway re the parent, my fourth result uses therapist as the example of uncovered providers, which would have been my guess https://www.consumerreports.org/health/health-privacy/guess-what-hipaa-isnt-a-medical-privacy-law-a2469399940/ https://www.consumerreports.org/health/health-privacy/guess-...
  - selinkocalar 3y ago
    Yup! Not every provider is classified as a Covered Entity and not every healthcare business is classified as a Business Associate. It's where the nuances of HIPAA law come into play. For example, you could be a medical app that processes pages and pages of medical data from an individual, but if you're not doing it on behalf of a Covered Entity, then you won't be subject to HIPAA. In cases like these, as well as certain therapist examples and other scenarios described in the final article you provided, HIPAA is not applicable. It's still good practice to have proper security measures in place, since there could be other governing bodies regulating you (e.g. the FTC, https://www.ftc.gov/news-events/news/press-releases/2018/10/federal-trade-commission-gives-final-approval-settlement-uber https://www.ftc.gov/news-events/news/press-releases/2018/10/...), but you're not regulated under HIPAA.

selinkocalar 3y ago

It's an interesting point you raise. You're correct in that our current target audience primarily covers the companies that provide services to healthcare providers instead of actual healthcare providers. For more context, HIPAA breaks companies into two categories: (1) Covered Entities, which are healthcare providers, health plans, and healthcare clearinghouses, and (2) Business Associates, which are companies that process PHI on behalf of Covered Entities. Behavioral/mental health providers fall into the Covered Entity category, and their requirements under HIPAA are different than those of Business Associates. Our services are currently focused on supporting Business Associate needs.

fhsm 3y ago
> … providers fall into the Covered Entity category … If doctor etc is a Covered Entity then that doctor is most likely a Provider, but is every doctor providing healthcare a really CE? I wouldn’t have said no but I don’t track it ultra closely so I’m curious what’s the latest? My first three results matched my expectation but they could easily be out of date… https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-covered-entity-if-you-dont-bill-electronically/ https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-co... https://www.stevenslee.com/health-law-observer-blog/is-a-cash-only-medical-practice-subject-to-hipaa/ https://www.stevenslee.com/health-law-observer-blog/is-a-cas... https://www.americares.org/wp-content/uploads/globalassets/_snc/eduresources/practicefacility/hipaa/2.-hipaa-faqs-may-2014.pdf https://www.americares.org/wp-content/uploads/globalassets/_... Anyway re the parent, my fourth result uses therapist as the example of uncovered providers, which would have been my guess https://www.consumerreports.org/health/health-privacy/guess-what-hipaa-isnt-a-medical-privacy-law-a2469399940/ https://www.consumerreports.org/health/health-privacy/guess-...
- selinkocalar 3y ago
  Yup! Not every provider is classified as a Covered Entity and not every healthcare business is classified as a Business Associate. It's where the nuances of HIPAA law come into play. For example, you could be a medical app that processes pages and pages of medical data from an individual, but if you're not doing it on behalf of a Covered Entity, then you won't be subject to HIPAA. In cases like these, as well as certain therapist examples and other scenarios described in the final article you provided, HIPAA is not applicable. It's still good practice to have proper security measures in place, since there could be other governing bodies regulating you (e.g. the FTC, https://www.ftc.gov/news-events/news/press-releases/2018/10/federal-trade-commission-gives-final-approval-settlement-uber https://www.ftc.gov/news-events/news/press-releases/2018/10/...), but you're not regulated under HIPAA.