Does HIPAA apply to independent doctor with no links to Medicare or other medical organization?

Question

When I spoke with my family doctor he was under the impression that HIPAA privacy rules applied to EVERY doctor or health care provider. Also a professor who teaches classes for emergency medical responders said the same thing.

HIPAA law says this:

42 USC 1320d-1: General requirements for adoption of standards a) Applicability: Any standard adopted under this part shall apply, in whole or in part, to the following persons:

1. A health plan.
2. A health care clearinghouse.
3. A health care provider who transmits any health information in electronic form in connection with a transaction referred to in section 1320d–2(a)(1) of this title.

HIPAA Administrative Simplification Regulation Text expands it to associates:

§ 160.102 Applicability.

(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to the following entities:

1. A health plan.
2. A health care clearinghouse.
3. A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

(b) Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate.

It seems clear that this DOES NOT apply to my doctor. He has no contract with Medicare or any other health care organization (cannot be called a business associate). He does not transmit PHI (Private Health Information) in electronic form. He does not take insurance. HIPAA only regulates those who send information electronically. It does not regulate everyone.

This situation may be rare in our modern world but it happens. So who is wrong: me or the doctor?

Answer 1

I tried hard to make the doctor subject to the rules, but really couldn't. He would have to be

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

or, for some purposes, a "business associate". The law does not define transmiting in electronic form, but it does define "Electronic media" to include "Transmission media used to exchange information already in electronic storage media". Crucially, though,

Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission

So making a VOIP phone call would not count. But: if the doctor has computer files, and may read some such information over ordinary land lines, that constitutes exchange of information already in electronic storage media. If the doctor only has paper records, then his transactions are not covered, unless he happens to be a business associate. However, accepting a referral from a covered entity does not make you a covered entity: a business associate specifically does not include

A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual

so he appears to not be covered at least by this portion of HIPAA (Title II). This all presumes that there are no state requirements to obey HIPAA.