If a medical worker tells someone the first name of a child born at a hospital on that day, is that a violation of the Health Insurance Portability and Accountability Act (HIPAA) ? Does it make a difference if the hospital publicly posts a photo of said newborn on Facebook with his name?
The rule prohibits public disclosure of protected health information which is individually identifiable health information that is stored, and individually identifiable health information is health information that is identifiably about a specific individual. The term health information
means any information, including genetic information, whether oral or recorded in any form or medium, that:
(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.
The name of an individual is not health information, whereas a diagnosis about them is. Arguably, revealing the medical fact that they were born is health information. Newborns are legally and logistically incapable of consent, so consent may have been obtained from the parents.