That's 250k per violation fine, and leaking status positive or negative is a violation. And every person, and every time they pass that information to every "partner" is a distinct violation.
If the vendor is a HIPAA covered entity, which Grindr isn't.
> it doesn't matter what your business is,
Yes, it does.
> health information is covered by HIPAA.
PHI held by HIPAA covered entity or by a business associate on behalf of such an entity, sure. Health information shared by the subject outside of a healthcare context, OTOH...
"The Security Rule applies to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with a transaction for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”) and to their business associates."
via https://www.hhs.gov/hipaa/for-professionals/privacy/index.ht...
"The HIPAA Privacy Rule establishes national standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically."
in what circumstances has HIPAA been found to apply to businesses other than those?
Declaring your HIV status on Grindr is voluntarily and knowingly sharing your own health information into the public domain. It is much closer to tweeting it out than telling a medical professional imo.
HIPAA has nothing to do with Grindr unless it starts an acute care clinic.