Suppose that a developer creates a website where people can enter daily information on how they feel (energy, back pain, mood, etc.). A person's information would be available to his or her nutritionist, who may or may not have any formal certifications. Would such a website require HIPPA-level protections (in the United States)? Would it if people were also expected to report whether they have any serious medical conditions, such as cancer?
It first depends on whether you are a "covered entity". This is laid out in 45 CFR Part 160. §160.103 defines the various terms such as "covered entity", "business associate", "health plan", "health care clearinghouse", "health care provider", "health care" and so on. It is important to read all of the definitions and terms that they refer to. If you qualify as a "covered entity", then read Part 164 esp. subparts A, E, which say what must be done to comply with the law. It is fairly complicated, and if you don't want to hire an attorney to interpret these parts of the law as applied to your situation, there is no harm in assuming that you are subject to the restrictions. Still, you probably have to at least hire an attorney to figure out what the restrictions are, if you don't already know. But this is where the answer lies.
Firstly, HIPAA is intended to restrict what information may be released without the consent of the patient (or guardian where applicable). Any information may be released in accordance with the patient's written and informed consent.
Secondly, HIPAA applies only to "covered entities". (See detailed definitions below.) These include: Healthcare providers, Health plans, and Healthcare clearinghouses. Some of the rules also apply to "Business Associates" of covered entities These are entities that perform services for covered entities, normally on a contractual basis.
If a website as described in the question is not run by a covered entity (as it seems from the question it would not be) and is not run by a Business Associate of covered entity, then the HIPAA Privacy Rule would not apply to the operator of the site.
If the operator is, or is part of, a covered entity, or the operation is not sure if s/he fills under the definition of a covered entity, the site operator must comply with the Privacy Rule.
One way to comply is to obtain the specific informed written permission of the patient (or the patient's guardian) for the kinds of disclosures that the operator intends to make, whether via the site or otherwise. Disclosures for which the patient has given specific informed consent are not HIPAA violations.
If the operator is a covered entity, s/he must store all protested health information securely, in compliance with the HIPAA Security Rule. If not the HIPAA rules do not apply, but other laws may impose on the site operator a duty of "reasonable care" with such protected information. The operator should make sure that current best practices are followed, in order to prevent or hinder unauthorized access to the protected information.
Laws and Regulations
The Health Insurance Portability And Accountability Act Of 1996 (PUBLIC LAW 104–191—AUG. 21, 1996) (HIPAA) does not include the detailed privacy regulations. Those are contained in the Privacy Rule As the CDC HIPPA page states:
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to implement the requirements of HIPAA. The HIPAA Security Rule protects a subset of information covered by the Privacy Rule.
The HIPAA Privacy Rule
The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information (collectively defined as “protected health information”) and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. The Rule also gives individuals rights over their protected health information, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their protected health information in an electronic health record, and to request corrections.
The following types of individuals and organizations are subject to the Privacy Rule and considered covered entities:
- Healthcare providers: Every healthcare provider, regardless of size of practice, who electronically transmits health information in connection with certain transactions. These transactions include claims, benefit eligibility inquiries, referral authorization requests, and other transactions for which HHS has established standards under the HIPAA Transactions Rule.
- Health plans: Entities that provide or pay the cost of medical care. Health plans include health, dental, vision, and prescription drug insurers; health maintenance organizations (HMOs); Medicare, Medicaid, Medicare+Choice, and Medicare supplement insurers; and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government- and church-sponsored health plans, and multi-employer health plans.
Exception: A group health plan with fewer than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity.
- Healthcare clearinghouses: Entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa. In most instances, healthcare clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or healthcare provider as a business associate.
- Business associates: A person or organization (other than a member of a covered entity’s workforce) using or disclosing individually identifiable health information to perform or provide functions, activities, or services for a covered entity. These functions, activities, or services include claims processing, data analysis, utilization review, and billing.
[The above seems to be copied directly from 45 CFT 160.]