Comment by theli0nheart | Hacker News Reader

Comment by theli0nheart | Hacker News Reader

Parent Full thread

Business associates absolutely must abide by the HIPAA Privacy Rule.

> By law, the HIPAA Privacy Rule applies only to covered entities – health plans, health care clearinghouses, and certain health care providers. However, most health care providers and health plans do not carry out all of their health care activities and functions by themselves. Instead, they often use the services of a variety of other persons or businesses. The Privacy Rule allows covered providers and health plans to disclose protected health information to these “business associates” if the providers or plans obtain satisfactory assurances that the business associate will use the information only for the purposes for which it was engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with some of the covered entity’s duties under the Privacy Rule.

Source: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

A forensic lab doing things with DNA may have no business relationship whatsoever with any covered entity (in fact I would guess that this is the most likely case).

Doesn’t matter. If you’re a business associate, you’re liable (both criminally and civilly) for violations of the privacy rule, and if you share HIPAA covered data with other businesses, those businesses must also adhere to it.

There still has to be a covered entity involved. The HIPAA business associate rules are for business associates of covered entities.

In the case of a police department collecting DNA data for analysis by a police forensic lab there is no covered entity involved.

Other entities besides most state and local law enforcement that often have medical data but that are not covered by HIPAA include most private employers, state agencies such as child protective services, and most schools and school districts [1].

[1] https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/un...

My implication is that there’s no way to link up DNA to an individual without having a reference point. A hospital or lab (both covered entities) would provide this data (perhaps under subpoena?), and would ostensibly be working directly with the forensics lab in these cases. How else would they link up DNA (which is by itself not PHI) to an identity?

So then the hospital or lab are under HIPAA, but not the forensic lab.

That's not how it works. If the hospital or lab provides PHI (protected health information) to the forensic lab, the forensic lab must sign a business associate agreement with the HIPAA covered entity that gives assurances to them that any PHI will be protected. If a breach occurs, then the forensic lab is liable for full HIPAA penalties.

How does that work for Apple Health?

Apple Health facilitates transmitting electronic health records on one's device with covered entities such as clinics. For this reason, they are required by law to maintain HIPAA compliance when entering into a business agreement with these covered entities.

Reply on news.ycombinator.com