2

When I spoke with my family doctor he was under the impression that HIPAA privacy rules applied to EVERY doctor or health care provider. Also a professor who teaches classes for emergency medical responders said the same thing.

HIPAA law says this:

42 USC 1320d-1: General requirements for adoption of standards a) Applicability: Any standard adopted under this part shall apply, in whole or in part, to the following persons:

  1. A health plan.
  2. A health care clearinghouse.
  3. A health care provider who transmits any health information in electronic form in connection with a transaction referred to in section 1320d–2(a)(1) of this title.

HIPAA Administrative Simplification Regulation Text expands it to associates:

§ 160.102 Applicability.

(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to the following entities:

  1. A health plan.
  2. A health care clearinghouse.
  3. A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

(b) Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate.

It seems clear that this DOES NOT apply to my doctor. He has no contract with Medicare or any other health care organization (cannot be called a business associate). He does not transmit PHI (Private Health Information) in electronic form. He does not take insurance. HIPAA only regulates those who send information electronically. It does not regulate everyone.

This situation may be rare in our modern world but it happens. So who is wrong: me or the doctor?

  • 1
    Are you sure he doesn't transmit data in electronic form? How does he bill your insurance for services? I would find it hard to believe he sends your insurance a paper invoice written by hand... – Ron Beyer Aug 1 '18 at 19:25
  • 1
    @RonBeyer He literally does not take insurance. Hard to believe but true. – D_Bester Aug 1 '18 at 19:26
  • I suspect the narrow scope is because of the constitutional limitation of federal power. They need to justify the law as relating to interstate commerce. Other laws that did not meet the justification were struck down. e.g. drone registration; Accountant PTIN registration – D_Bester Aug 1 '18 at 19:28
  • 1
    OK, how does he bill you for his services? Again is it hand written invoices, or does he email you an invoice later? Does he have any clients which would fall under an electronic submission of a transaction? – Ron Beyer Aug 1 '18 at 19:36
  • 1
    @RonBeyer Sorry to take so long to respond; my satellite link went down when my diesel generator ran out of fuel. Anyway here where I live all the doctors write the invoice on tree bark and we pay in gold coins. – D_Bester Aug 1 '18 at 20:03
1

I tried hard to make the doctor subject to the rules, but really couldn't. He would have to be

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

or, for some purposes, a "business associate". The law does not define transmiting in electronic form, but it does define "Electronic media" to include "Transmission media used to exchange information already in electronic storage media". Crucially, though,

Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission

So making a VOIP phone call would not count. But: if the doctor has computer files, and may read some such information over ordinary land lines, that constitutes exchange of information already in electronic storage media. If the doctor only has paper records, then his transactions are not covered, unless he happens to be a business associate. However, accepting a referral from a covered entity does not make you a covered entity: a business associate specifically does not include

A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual

so he appears to not be covered at least by this portion of HIPAA (Title II). This all presumes that there are no state requirements to obey HIPAA.

  • Even if there are not state requirements to obey HIPAA, medical doctors had duties of confidentiality under state law ethics rules long before HIPAA existed that impose somewhat similar obligations (the obligations are similar to, but not identical to, the confidentiality obligations of lawyers). A lot of the goal of HIPAA was to make people who weren't subject to the confidentiality rules that applied to doctors subject to similar rules as the bureaucracy expanded and there were people needing to deal with health care information beyond true medical doctors and their immediate office staff. – ohwilleke Aug 1 '18 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.