4 ms·
So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.
by roegerle 2y ago
So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.
- otterley 2y agoThe site might be deemed a Business Associate, depending on the specific facts, which we don't fully possess. That's why I recommended the owner seek counsel.
- roegerle 2y agoA business associate to who? The user?
- bagels 2y agoA covered entity (eg. doctor, nurse, etc.)
- yunwal 2y agoHow could this app possibly be considered a business associate to a provider? The provider has no idea it’s even being used, let alone a formal association with the application.
- bagels 2y ago"Kate's App is a tool created to support medical caregivers" The landing page doesn't make it clear whether providers are expected to use it or not.
- otterley 2y agoLook up the definition of “provider” in HIPAA’s text. The definition is extremely broad and doesn’t just cover doctors and pharmacists.
- yunwal 2y agoIt’s not really that broad. It amounts to medical professionals (doctors, nurses, etc.), insurers, and any systems they use to store or process data. If the medical professional or insurer is not using the app, and the app has not signed a BAA with them, then it’s not covered under HIPAA. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- deleted 2y ago[deleted]
- daveguy 2y agoThis is not true. I'm not a lawyer, but I am in the healthcare field. HIPAA very much applies to this type of app or any other type of app that may deal in personally identifying information (PII) related to healthcare.
- roegerle 2y agoI was too. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- daveguy 2y agoIt would be a mistake to assume a SaaS that stores healthcare PII for coordinating healthcare is not covered under HIPAA. An exception should be filed at the very least. Edit: If no healthcare provider has access then maybe it could skate by. I interpreted "any user making notes to your account" to mean healthcare providers would have access. Even if not, they should still seek legal counsel. And this app is literally promising safety and security of healthcare information.