Hacker News Reader

Comment by Dylan16807 | Hacker News Reader

That seems like a terrible definition to me.

At the least it's very misleading to say the only thing that matters is PHI, with a hidden footnote saying that PHI means "records that HIPAA cares about, gotten in a way that HIPAA cares about".

Even if that's the definition in the law, call it "HIPAA PHI" or something, since it seems to me that it's definitely not supposed to be a general-purpose definition of PHI.

View on HN

I disagree.

You need to have a definition of health information that falls under HIPAA. That definition is PHI because it’s literally Protected by HIPAA.

Calling any health information “PHI” bakes in bad assumptions by both parties.

The data my phone gathers on me is the same data my doctor might. It’s PHI when my doctor generates and stores that data. It’s not when I do it. This is a good distinction.

The way I see it, while the distinction you describe is correct, there's a reasonable desire that this distinction should not exist and if some app on your phone collects private health data then that data should get the same protections as if your doctor collected it; and if the app developer wants to store and process that data then they'd better be able to comply with HIPAA-like requirements or stop handling sensitive data. It's not like it currently is, but we can try and get there.

PHI means protected health information. Protected means protected by HIPAA. By definition, there is no PHI not protected by HIPAA. HIPAA is concerned with what health information must be protected and defining that defines PHI.

The exact same information can be held by two different companies, yet only one of those companies is obligated to protect it.

Reply on news.ycombinator.com