it's an onerous law and many people now cite it when they don't want to provide information, even if the law doesn't apply to them.
If you are a "covered entity" try and work out if you can stop being one. If you can avoid collecting HIPAA relevant data and still make your business model work, that's likely to be a significantly easier path to take than ensuring ongoing compliance. (Same as PCI compliance - outsource all that brain damage to Stripe or Square or whoever, and be able to look a judge in the eye and say "We never even see credit card data.")
Don't collect information, don't store it, unless absolutely necessary and you can't find an expert certified third party to handle it for you.
Absolutely use a PSP to minimize your wasted effort on compliance activities, but also choose a sane QSA.
https://epayments-support.ingenico.com/en/direct/faq/compari...
It’s actually way simpler than a lot of people here are making it out to be.
If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
> If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
IANAL
I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates.
Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition.
Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov....
> The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule.
> Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards
So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA.
If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so.
I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
> “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities”
They don’t use PHI here for a reason.
When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI.
Therefore, I believe my statement still stands.
At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about".
Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA.
Calling any health information “PHI” bakes in bad assumptions by both parties.
The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
It doesn't apply obligations to all people who might receive Protected Health Information.
If a hospital makes an error, and emails the medical charts for a public figure to a journalist, the journalist has no obligations under HIPAA. They would be free to publish the information, to store it without privacy safeguards, etc.
The data remains PHI, but the journalist is not required to follow the HIPAA privacy rule. Though, I again think it would generally be better if the voluntarily did so.
By my (again, also a non-lawyer understanding) the privacy rule is a venn diagram that only applies if:
- You are a Covered Entity or Business Associate, AND - The data being handled is Protected Health Information
There are very challenging compliance frameworks. HIPAA isn’t one of them.
I’m a bit confused. I was just giving a hypothetical product (I’ve seen similar on the market), that I can guess with high probability has not implemented protocols that I would consider proper for HIPAA.
So, maybe my SAT comprehension is abysmally low... I’m not sure what you’re saying there.
The number of people I know who conflate "human subjects data" and "HIPAA data" is staggering.
Over my decades in IT I've seen plenty of things by accident (and once, not-accident. A guy was getting a lot of gay "spam" and wanted me to stop it. I went along with the cover story, knowing perfectly well it was message digests from a forum he had to have signed up for.) None of it gets repeated other than anonymized.
The solution is clearly to not record students in any identifiable way, but there’s no need to avoid recording the lecture altogether. In fact, if the student were not identifiable, I expect it would be perfectly legitimate to record them without any explicit consent.
Disclaimer: I am not a lawyer, this isn’t legal advice
Some examples of actual GDPR enforcement cases for mishandling of employee information:
https://www.complianceweek.com/regulatory-enforcement/german... - general video surveillance of employees;
https://www.infosecurity-magazine.com/news/hm-fined-352m-for... - one of the biggest GDPR fines, for tracking various (IMHO clearly unreasonable) private data of employees;
https://dataprivacymanager.net/725000e-gdpr-fine-by-dutch-dp... - collecting employee fingerprints in an inappropriate manner.
https://inplp.com/latest-news/article/EUR-150000-gdpr-fine-i... - employer asserting that a "consent" form that they forced all employees to sign counts as actual consent.
I'm not saying that this necessarily prevents recording of lectures, but it also doesn't seem to be the case that you can "just do it" without properly accessing the legal aspect.
The idea that you should protect your Grandma’s healthcare data and encrypt it should not be considered onerous.
If software development was actually “real” engineering, we’d have no need for HIPAA and something as obvious as its risk management statute.
HIPAA is what happens when the tech industry acts irresponsibly and fails to police itself. We continue to choose features over security/maintenance.
Do you think building codes and fire codes were thought up out of thin air?
Do you think the FDA came into existence just because?
The SEC was created in 1933, as direct result of the Great Depression. Dodd-Frank and CFPB were a direct result of the 2008 financial crisis.
Every discipline starts out without regulation, until it inflicts some injury upon society that motivates the creation of regulation, which then often calcifies the industry and creates barriers for new entrants. The difference with data is just that we happen to be alive to see that transformation taking place.