> If you are storing OR transmitting PHI you are required to be HIPAA compliant. That’s it.
IANAL
I don't think that's accurate or correct. I think that is how all parties should behave, but that is not what the law mandates.
Covered Entities are the only original entities that are required to be HIPAA compliant. That's a relatively specific definition.
Here's a source to the NIH which supports my position: https://privacyruleandresearch.nih.gov/pr_06.asp#:~:text=Cov....
> The Privacy Rule applies only to covered entities. Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule.
> Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards
So if you are not a Health Plan, a Health Care Clearinghouse, or a Health Care Provider; and you have not entered into a formal contractual relationship (known as a BAA) with one of those three entities then you are not subject to HIPAA.
If you are not a Covered Entity, you can ask for people to submit their PHI to you in plain-text. If they do, you could store it in plain-text. Again, I want to be really clear: *you should not do this*, but it would be legal to do so.
I think if you are storing or transmitting PHI you should be required to be HIPAA compliant, but it's just not correct to say it is categorically so.