Hacker News Reader

HIPAA regulates covered entities and their business associates. It does not automatically regulate anyone who asks for or receives health care information.

I could ask you to post your symptoms here on HN and if you chose to do so, neither I nor Ycombinator would be at risk of fines related to HIPAA. I very much doubt this random person working on a personal project would either.

View on HN

Ok, but the clinicians and SMEs they'd be working with would be covered entities, and that would make him a business associate.

If his system records a symptom they have, attaches that to a stable piece of PII, then refers them to a covered entity for treatment, that makes the symptom, the PII and the treatment referral all PHI and therefore bound by HIPAA.

He would need to have a contractual relationship as a vendor or service provider to a covered entity to even maybe qualify as a business associate. Does he have that? I doubt it, this just seems like one person’s side project.

Reply on news.ycombinator.com