Hacker News Reader

Comment by SkyPuncher | Hacker News Reader

I will die on this hill. I ran a HealthTech company and we spent extensive time and legal counsel understanding our HIPAA obligations.

For example, if a provider is cash-only, they are not bound by HIPAA.

----

It's really important to see the nuance in the definition of a covered entity: https://www.hhs.gov/hipaa/for-professionals/covered-entities...

> This includes providers such as:

> Doctors

> Clinics

> Psychologists

> Dentists

> Chiropractors

> Nursing Homes

> Pharmacies

> *...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.*

Emphasis mine. That last sentence is the big "gotcha" on who HIPAA applies to.

View on HN

You are correct that HIPAA only applies to entities who engage in insurance-related transactions, and that a cash-only provider would not be bound by it, and you are right to point this out as an important limitation.

At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

> At the same time, it does not apply only to insurance-based transactions; its applicability is on an entity level, not just a transaction level. A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

Also not true.

By default, if something in an organization is HIPAA-bound, the whole organization is. However, HIPAA allows organizations to be "hybrid entities". Essentially, should an organization have a desire, they can carve out the non-HIPAA compliant parts of their business as a "non-HIPAA entity".

You don't really see this in the "standard" healthcare system. It's simply far easier for everything to be treated under the same umbrella. Particularly, since most of them stand to gain nothing additional than the transaction-for-healthcare piece.

However, it seems far more common in the "direct-to-consumer" space where these companies are banking on secondary data and marketing plays.

>> A cash patient at a provider who engages in covered transactions is still protected by HIPAA.

> Also not true.

Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules?

The rest of your comment doesn't seem to explain this (or I didn't understand it.)

If true, This is deeply disturbing, as it's not unusual that I pay in cash. I always assumed that I had even better privacy because no insurance company was being informed of my visit. it would mean that HIPAA isn't just weaker than people think, it's extremely weak.

It’s getting into territory that’s beyond my complete comprehension and ability to explain. There’s also a difference between what’s technically possible and what’s practical. Most places aren’t putting the effort into splitting.

If your doctor accepts insurance, they’re likely treating everything as though it’s covered by HIPAA. If your doctor is cash-only, then they are not bound by HIPAA (unless they have some other agreement that binds them).

> Wait, what? So if I'm paying my doctor in cash, then my doctor is not bound by HIPAA rules?

Only if the doctor does not accept any insurance payments at all (ie, from other patients). If they're "in network" with any insurance provider, they're generally required to abide by HIPAA for all patients. It's possible to get around that, but most independent providers aren't going to bother, and neither are larger health systems. Smaller practice conglomerates (e.g. the for-profit startups you see advertising on social media) are the ones most likely to be be taking advantage of this.

The main other case where you see this come up is outpatient therapy or psychiatry, because providers in most other contexts are not 100% self-pay, but many mental health providers are 100% self-pay.

> it would mean that HIPAA isn't just weaker than people think, it's extremely weak.

HIPAA is extremely weak. It's better than nothing, because the few protections it gives are important, but it's nowhere near sufficient.

Wow. I definitely learned something today.

Reply on news.ycombinator.com