Hacker News Reader

Comment by RcouF1uZ4gsC | Hacker News Reader

From https://compliancy-group.com/hipaa-fines-directory-year/

"The federal fines for noncompliance are based on the level of perceived negligence found within your organization at the time oft he HIPAA violation. These fines can range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for each violation. View our HIPAA fines chart below for the full HIPAA fines list."

And on the same page, according to the HIPAA Violation Penalty Tiers, the fourth and worse tier is "The covered entity acted with willful neglect and failed to make a timely correction".

I bet if these companies got sued for $50,000 per person using them who had their data leaked to facebook, it would get everyone's attention really quickly.

View on HN

Please see the comment I wrote regarding HIPAA and covered entities.

Voluntarily submitting your information to an app that keeps a calendar of your period is not subject to HIPAA jurisdiction

and thats just the cynical response to make fun, so more specifically, it comes down to the company itself that releases these apps, and they are not HIPPA covered entities.

It's unfortunate that now every piece of data about us is being used in some way other than what we would naturally expect. Though we also seem to expect free applications and websites...

When writing medical software, HIPAA was an ever-present monster forcing me to consider all potential ways we'd be under a company-ending event. Once your fine totals exceed $100,000, you're required to issue a press release detailing how bad the damage is, in addition to the fines that stack for each violation (each patient's record would be considered one "violation").

I'm surprised any company keeping health information would be willing to sell that data without extensive legal protection, whether or not that data is protected explicitly under HIPAA. Seems to me like this should be treated like any other PHI breach.

What about those DNA companies that collect even more sensitive medical information - your DNA - and then straight up sell it to companies who'll use it against you (health insurance)? Why are these guys not facing billions in fines and being dissolved for egregious violations?

Edit: It seems that none of these are HIPAA violations because these companies aren't classified as medical organisations.

They wouldn't be subject to HIPAA, but they would be subject to GINA.

https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim...

It's unfortunate, but as another commenter noted these applications are not subject to HIPAA.

Reply on news.ycombinator.com