I've worked for various healthcare companies and found there's a wide range of interpretation to what protected HIPAA data is. It should be more cut and dry, but in actual practice it seems to be a little confusing.
Can one of the 18 identifiers be PHI by itself, without having any medical information attached to it? For example an first and last name from an EHR system. I have always thought you need some sort of medical information attached with the 18 identifiers to make it PHI, otherwise without the health information, it's PII. So a first and last name with the diagnosis of diabetes is PHI, but my first and last name is not PHI, only PII.
Does it matter where the information originated from? For example if a person inputs their health information into a healthcare website, say weight and medical condition, is that different from a doctor inputting that same data into their EHR?
The definition states that it's protected if the covered entity receives the information - but what if the patient gives health information (let's say weight and medical conditions) to a downstream business associate (with a signed BAA)? I thought HITECH extended liability to downstream associates as if they were the covered entity.
It's worth posting the definition of protected health information for reference.
Under HIPAA, protected health information is considered to be individually identifiable information relating to the past, present, or future health status of an individual that is created, collected, or transmitted, or maintained by a HIPAA-covered entity in relation to the provision of healthcare, payment for healthcare services, or use in healthcare operations (PHI healthcare business uses). Health information such as diagnoses, treatment information, medical test results, and prescription information are considered protected health information under HIPAA, as are national identification numbers and demographic information such as birth dates, gender, ethnicity, and contact and emergency contact information. PHI relates to physical records, while ePHI is any PHI that is created, stored, transmitted, or received electronically. PHI only relates to information on patients or health plan members. It does not include information contained in educational and employment records, that includes health information maintained by a HIPAA covered entity in its capacity as an employer. PHI is only considered PHI when an individual could be identified from the information. If all identifiers are stripped from health data, it ceases to be protected health information and the HIPAA Privacy Rule’s restrictions on uses and disclosures no longer apply.