> “ Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities”
They don’t use PHI here for a reason.
When an individual, not a provider or insurance company, submits a health record to you, it’s not technically considered PHI.
Therefore, I believe my statement still stands.
At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about".
Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.
You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA.
Calling any health information “PHI” bakes in bad assumptions by both parties.
The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.
It doesn't apply obligations to all people who might receive Protected Health Information.
If a hospital makes an error, and emails the medical charts for a public figure to a journalist, the journalist has no obligations under HIPAA. They would be free to publish the information, to store it without privacy safeguards, etc.
The data remains PHI, but the journalist is not required to follow the HIPAA privacy rule. Though, I again think it would generally be better if the voluntarily did so.
By my (again, also a non-lawyer understanding) the privacy rule is a venn diagram that only applies if:
- You are a Covered Entity or Business Associate, AND - The data being handled is Protected Health Information