Does HIPAA apply to telecom equipment vendors or telecom services?

Question

Some time ago, while filling a prescription at a pharmacy in a chain store, I was asked if I wanted to receive text messages when my medication would be ready. I agreed.

Now, whenever my order is ready, the pharmacy texts me not only that it is ready, but also which particular medications are ready to be picked up. I never consented to have my medical information revealed to the phone company. I never consented specifically to have the names of the medications texted to me. The only thing I did consent to was to receive texts when a medication order would be ready for pick up.

It is my understanding that phone companies are not required to share with anyone my private information without a warrant, but it's also not illegal for them to do so if they so choose.

• Is it a HIPAA violation for the pharmacy to reveal this information to the phone company (in this manner) without my explicit consent?
• Is it a HIPAA violation for the phone company to keep this information about me?
• Is it a HIPAA violation for the manufacturer of the phone to scan my phone (while gathering telemetry without my consent)? I realize that this my violate some other laws, but I am specifically asking about HIPAA.
• Is it a HIPAA violation for the manufacturer of the phone to keep this information about my specific medications without my explicit consent? I have given the manufacturer of the phone consent to take other actions (such as upgrade the phone firmware), but not specifically to track my medications.

Answer 1

Phone companies and phone manufacturers are not themselves subject to HIPAA, although they are subject to some other privacy laws.

But the pharmacy, to be HIPAA compliant, needs to either have a non-disclosures agreement with the phone company that bars it from disclosing the information contained in the text messages (unless other privacy laws already bar it from doing so), or needs to tailor the content of its text messages such that HIPAA covered information is not disclosed.

My pharmacy takes the latter course, but the former option ought to also be acceptable and compliant.