Comment by WaitWaitWha | Hacker News Reader

Comment by WaitWaitWha | Hacker News Reader

Parent Full thread

I appreciate what you are trying to say (I think) but the way this is presented seems to contradict previous statement.

> The resulting data is then securely sent over to us (we’re HIPAA compliant)

So the material is considered and under the protection of HIPAA.

> At no time shall your Personal Information, including blood or metabolomic data collected from you in accordance with this Privacy Policy be deemed to be an electronic health record or an electronic medical record for any purpose, including without limitation for the purpose of compliance with the Health Insurance Portability and Accountability Act of 1996.

This reads like 'because we do not consider your data to be PHI, therefore it is not under HIPAA.' ergo, lose all HIPAA protection.

Might want to re-write this if that is not what you meant.

I also read that as “we can sell this data”.

The thing you need to remember with consumer protection is that a failing company will abandon everything including ethics in order to pay the piper. Especially after they have laid you off.

There’s a reason some capital E ethical companies put poison pills or time bombs in their charter. Booby traps of this sort actually instill trust in people who have heard a line of bullshit so often they can see it a mile away.

The legal language here can indeed be confusing. EHR and PHI are not the same thing. What is important is that your personal information will not be shared with anyone. We will make sure that the language on our webpage is more concise, thank you for pointing this out.

HIPAA only covers business associates, covered entities and subcontractors. I’m guessing this company is neither of those three. Therefore the “PHI” you provide to them, is not “PHI” under HIPAA since you are providing the data, and not a covered entity.

I've seen this literature used before, you can make such a claim if you are a transmitter of data, e.g. a SMS carrier. However this would certainly fall flat on its face if you were a actual EHR / EMR.

Reply on news.ycombinator.com