Inspired by a tweet I saw a moment ago:


She's a nurse and not only do I know that her sister in law N**** is coming in from out of town, she had a BBL and is worried about leakage while on the plane. I think this is a Hipaa violation?

Names censored.

In this case, does the profession of the lady talking about her sister in law, medical nurse, automatically mean that HIPAA applies and she is illegally sharing private medical data without patient consent? Or does HIPAA only apply to medical professionals when the data concerns that of one of their official patients?

1 Answer 1


The rule applies to "A covered entity or business associate", who may not "use or disclose protected health information" except as permitted. The set of covered entities and business associates is pretty large, and certainly covers nurses, also secretaries working for the hospital or insurance company. It is not restricted to the doctor-patient relationship. However, the restriction is not absolute: a patient can consent to the disclosure of such information: but, the consent must be written.

This raises an interpretive challenge, in case patient A reveals a medical fact to a friend B who happens to be a medical professional. Person B probably is a "covered entity", since they are undoubtedly

A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

The information also is "protected":

Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years.

Para 5 on prohibited uses and disclosures explicitly lists the prohibited disclosures (genetic information for insurance underwriting, sale of PHI), so idle gossip is not explicitly prohibited. It is also not explicitly allowed. But again, the regulation says:

may not use or disclose protected health information, except as permitted or required by this subpart

Nothing in the rules limits the obligation of a "covered entity", in terms of how they came to be in possession of PHI. Given the definition of "covered entity", the fact of being a covered entity is a property does not depend on obtaining information electronically. So without written consent, B who is a covered entity cannot gossip about A's medical status.

  • I think the core legal issue (which I don't presume to know the answer to) is whether the information must be obtained in the course of one's health related business or occupation or at least in the course of engaging in health care related activities, even if a patient relationship hasn't been formed (e.g. in the case of a prospective patient) or isn't intended (e.g. in the case of an insurance company), as opposed to in the course of activities by an individual outside the scope of their occupation or business and not seeking health advice (e.g. communications with a friend or relative).
    – ohwilleke
    Commented Apr 7, 2022 at 20:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .