Hacker News Reader

Comment by o11c | Hacker News Reader

For this specifically, shouldn't HIPAA apply and quite strictly at that?

Unlike the general Internet where laws are so poor that an opt-out hidden checkbox is sufficient as "consent", HIPAA is quite specific on what is needed and who needs to get it.

View on HN

> Reierson is especially disturbed by how Vibrant and SAMHSA are characterizing 988Lifeline as not a mental health service—thereby removing public legal protections that exist with health services even as 988Lifeline operates like a health service by providing counseling, keeping records on callers, and instigating police wellness checks and mobile crisis team visits with or without consent. “That makes 988 dangerous,” he said. “If we continue on as we are, these problems of accountability are just going to entrench further.”

I'm super-tired by how much of the US legal system consists of bullshit arguments about definitions. A great deal of legal strategic maneuvering these days is about challenging who gets to make such definitions or demanding courts admit obscure/specious ones, in order to then insist on rigid, mechanistic (and often draconian) interpretations of law incorporating the 'preferred' meaning.

The Constitutional requirement for a common-law legal system only works to the degree that there is common agreement on basic premises. Once linguistic definitions come to be viewed as strategic legal territory to be captured, the system is bound to collapse under the weight of its own contradictions.

Title II of HIPAA should just be extended to apply to all data about all people, so it doesn't matter whether it's ackshually health data or not. Then, all the lawyers arguing about who's a "covered entity" and who isn't, what's "protected health information" and what isn't, can go get bent.

The data protection rules provided by HIPAA are actually pretty good, especially for a privacy-hostile country like the USA. I'd love see something like HIPAA act as the model for a generic (non-healthcare) data privacy protection law, if Congress could get their shit together and propose it.

Arguing about definitions isn't new. Have a look at the history of the definition of 'contract' in common law (https://en.wikipedia.org/wiki/Contract#Common_law_contracts is a good starting point, I guess). It's full of such nitpicking around definitions.

No disagreement here. I'm not fond of contract law because of teh sort of adversarial legalism it imho promotes. But that's a much bigger discussion than comfortably fits here.

Well, a contract it something you draft up in good times, when you understand each other, to provide an enforcement mechanism in bad times (if/when you have disagreements).

The ideal contract has enforcement mechanisms that are really easy to predict, so that both parties can just settle around that predicted outcome, instead of actually having to go to court.

The actual mechanisms aren't that important, as long as they are predictable. If eg bankruptcy law in your jurisdiction predictably benefits creditor (or debtor) more, then the original agreement (when people still agree with each other) can adjust for that.

For somewhat complicated reasons that can be simplified to them not billing insurance, I don't think most crisis text lines are going to qualify as covered entities under HIPAA.

I think they're still considered a "business partner" and subject to HIPAA iirc.

You'd think but they basically just slapped little "oh we aren't actually healthcare" snippets in their licenses and are hoping that's enough to get them out of actually being required to comply with HIPAA despite them very clearly needing to.

So yeah it should apply but they are just claiming they aren't a mental healthcare service to avoid it despite them being a literal mental health crisis hotline.

It probably won't hold up but it might be enough to lessen penalties since they can feign ignorance.

I don't think HIPAA cares in the slightest about how a company calls themselves. If their normal operations involve working with what law says is a PHI, they gotta be compliant, even if they identify as a construction company (j/k).

Or at least I was given this impression from my compliance trainings.

“I didn’t know I couldn’t do that.”

HIPAA applies to far fewer entities than people think. Essentially only healthcare companies accepting insurance have to abide by it. There partnered do, but only transitively.

Reply on news.ycombinator.com