I work for a University that requires you to talk about your personal health with a chatbot. That data is then stored in a SQL database without knowing who has access to it, where it is, or how long it will exist.
Employer is in NY state.
HIPAA does not prevent your employer from collecting this data, it only states (to a certain degree) how that data can be used, shared and what company policies & procedures are needed etc. In general right now though, the FDA, CMS and other enforcement agencies have suspended many of the penalties/rules around data collection, sharing, device usage etc. I am not aware of any laws that would prevent your employer from asking these questions or storing the data, but I would say it will make them subject to the rules of medical record storage as technically that data can identify you and is related to your health. If they shared this data without getting a release from you or had a database compromised then they could be subject to fines and other penalties, but I doubt any of that would be enforced over the next 6 months or so.
Many states are requiring employers to monitor/check employees that are on-site, but most are not storing the data as far as I know, so I doubt they are doing anything illegal or improper, maybe creepy but nothing technically wrong.
In the OP's case it isn't so clear HIPAA doesn't apply, and IMO likely it may, because he works at a university and not a traditional private employer. If that university has a medical school or provides clinics to students/employees under the universities name (even contracted through a third party), then most legal advisors would say HIPAA rules must be followed. Also many states regulate the collection of health data by private employers, and with this being NYC who knows what is on the books.
I totally support a company wanting to do fever checks daily to prevent someone sick from entering the building while all this craziness is going on. But it gets creepy & frankly useless if they are relying on self-reporting and logging that to a database somewhere.
Employers aren’t generally in the scope of HIPPA, only medical providers and related business entities.
You’re not going to win this one, unless you can semipermanently work remotely.
I am amused by the chatbot idea here. Kinda Ad Astra like:
I suppose HIPAA might be broad enough to cover that but I think there are a lot more questions to answer if we're talking about something that is really covered by HIPAA or not.
Personally I wouldn't assume that anything health related is automatically HIPAA.
I would probably match the categories against HIPAA [0] as a starting point and then ask the university legal team if this was reviewed by them. If not, consider letting them handle it so that there is no retaliation against you if that project is neutralized.
[0] - https://www.hipaajournal.com/what-is-considered-protected-he...
We were not given details on who has access to the data, including any DBAs. Yes, this University owns a Medical Center, and the data is being collected on the Medical Center website. The code was produced by the University's Tech Transfer team. We do not know who manages the data, if it's the same as the people who manage patient data. I do not know if the legal team has reviewed the chat bot usage.
I've started off with some simple questions: Who has access to the data, where is the data saved, and how long will the data persist. Thank you for your additional questions, as I will use them to go forward.
This tool would fall under HIPAA compliance. In that, it doesn't matter if you know who has access to the data. The only thing that matters is that the holder of the data knows who has access to the data and whether those with access have proper training, metrics, and monitoring for the data. There are a lot of If's in this area.
If the data is anonymized, then there are a number of requirements that disappear.
If the data is not anonymized, then it must be kept for a certain period of time.
If the data is saved, it must be encrypted on ingress, egress, and at rest according to the HIPAA plan of the provider.
If... if... if...
There are a lot of considerations here. However, you don't actually get to know any of those things. The only part you get to know is whether they say "We are HIPAA Compliant". And if they say that and you disagree, you can make a complaint with the US Department of Health and Human Services.
Don't expect to get very many answers.
any public git repo? please
Or even taking your temperature makes more sense than this.