Hot answers tagged

38

As a short answer, guidance from the Department of Health and Human Services has clarified that HIPAA does not require hospitals to provide separate rooms. As a longer answer, HIPAA is very deeply misunderstood. It does not prohibit "leaking" patient information; it prohibits unreasonable and unpermitted disclosures of protected health information (PHI). ...


5

HIPPA applies only to specified entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); including Health Plans, Health Care Providers, Clearinghouses, and "Business Associates". Autopsy and toxicology records are the output not of a medical practice but of the coroner's office. The ...


4

Is It Legally Binding? While their customer service sucks, your oral authorization of the charge is legally binding (I take payments that way almost every day in my own business, it isn't an unusual business practice in small professional businesses). You authorize oral authorization of payments over the phone in the credit card agreement that your credit ...


4

Aside from all else, it's a matter of practicality. For instance ADA requires government facilities to be wheelchair accessible, but many stations in the NYC subway are not because it's impossible - or to be more precise, impracticable. Your thesis that HIPAA requires separate rooms would require either require a) that hospitals instantly slash their ...


4

HIPAA does not legally protect physicians from disclosing PHI to another party, although there are a few exceptions: HHS provides an excellent resource on these, but the regulation most relevant to your question is Permitted Uses and Disclosures (5) Public Interest and Benefit Activities, which includes "Required by Law. Covered entities may use and disclose ...


4

It is not legal to give false responses on such a declaration. The point of anti-discrimination laws is that they say when it is legal vs. not legal to discriminate against an employee, and Alex is expected to have faith in the legal system to protect his legal rights. Dissatisfaction with the outcome of the law may be understandable, but still does not ...


3

Gossiping about a patients medical information is a clear violation of the privacy rule, and significant enough that various HIPAA-compliance websites list this in their "10 things for medical professional not to do".


3

This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth ...


3

Under 45 CFR 164.402 a "breach" is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed ...


3

Sharur's answer is the correct one, but I wanted to chime in to note that even when records are covered by HIPAA, they may still be public records nonetheless, because HIPAA includes an exception (45 C.F.R. § 164.512) for uses "required by law": A covered entity may use or disclose protected health information to the extent that such use or ...


3

The regulations known as HIPAA are here. A good place to start is with who the regulations apply to. §160.10 lays that out: a health plan, health care clearinghouse, care provider, their business associates, and the Inspector General. Family members are not regulated entities. Subpart E regulates individually identifiable health information (such as "person ...


3

No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S....


3

The "logbook" is required by federal law, part of the Combat Methamphetamine Epidemic Act of 2005. See 21 USC 830 (e) (1) (A): Each regulated seller shall ensure that, subject to subparagraph (F), sales by such seller of a scheduled listed chemical product at retail are made in accordance with the following [...] (ii) The seller maintains, in accordance ...


2

HIPAA does not apply to aggregated data or data that has been stripped of personally-identifiable information. What is personally-identifiable to the government, you ask? Your name. Anything more specific about your physical location than the first three digits of your five-digit zip code. Month and day portions of dates attributed to individuals. It's ...


2

HHS answers FAQ 481: Does the HIPAA Privacy Rule permit doctors, nurses, and other health care providers to share patient health information for treatment purposes without the patient’s authorization? with: Yes. The Privacy Rule allows those doctors, nurses, hospitals, laboratory technicians, and other health care providers that are covered entities ...


2

You could offer to sell your own consent to use your records to a healthcare provider, and collect if the provider agreed. But that wouldn't make you a "broker" as I see it, only a one-tiem seller. To be a broker you would somehow have to convincew many others to let you act as their agent in selling such consent to various providers,at some sort of ...


2

This is not Legal Under HIPAA, a patient has a right to prompt access to all PHI, including medical records, maintained by a provider, with some very limited exceptions, none of which seem to apply based on the statements in the question. Access must be provided within 30 days at most, and the provider is encouraged to provide it as quickly as possible. If ...


1

The requirements are imposed on "the covered entity". You personally may not be required to do anything, apart from whatever your employer requires of you, but §164.404(a) says: A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has ...


1

Under 45 CFR 164.502, A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter PHI is defined in 45 CFR 160.103: Protected health information means individually identifiable health information: (1) Except as ...


1

The rule prohibits public disclosure of protected health information which is individually identifiable health information that is stored, and individually identifiable health information is health information that is identifiably about a specific individual. The term health information means any information, including genetic information, whether oral ...


1

HIPPA applies only to particular kinds of entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); such as Health Plans, Health Care Providers, Clearinghouses, and their Business Associates. If you are talking about a person storing his or her own health information and sharing it with ...


1

I tried hard to make the doctor subject to the rules, but really couldn't. He would have to be (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. or, for some purposes, a "business associate". The law does not define transmiting in electronic form, but it ...


1

An independent contractor can be treated as an employee of the covered entity (note that you are not actually an employee, just treated as such for HIPAA purposes). I got this from a conversation with someone at Accountable HQ who said this is a question they get asked frequently as this is a very common scenario and source of confusion. And this is what ...


Only top voted, non community-wiki answers of a minimum length are eligible