IANAL
It’s actually way simpler than a lot of people here are making it out to be.
If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
It’s actually way simpler than a lot of people here are making it out to be.
If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
> If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
IANAL
I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates.
Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition.
Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov....
> The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule.
> Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards
So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA.
If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so.
I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.
> “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities”
They don’t use PHI here for a reason.
When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI.
Therefore, I believe my statement still stands.
At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about".
Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA.
Calling any health information “PHI” bakes in bad assumptions by both parties.
The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
It doesn't apply obligations to all people who might receive Protected Health Information.
If a hospital makes an error, and emails the medical charts for a public figure to a journalist, the journalist has no obligations under HIPAA. They would be free to publish the information, to store it without privacy safeguards, etc.
The data remains PHI, but the journalist is not required to follow the HIPAA privacy rule. Though, I again think it would generally be better if the voluntarily did so.
By my (again, also a non-lawyer understanding) the privacy rule is a venn diagram that only applies if:
- You are a Covered Entity or Business Associate, AND - The data being handled is Protected Health Information