Private companies asking for Social Security Number? I thought that the privacy act (HIPAA) forbade use of the Social Security Number, or even asking for it, except by banks and federal agencies. Nevertheless, I frequently get asked for my Social Security Number by private companies. For example, I just asked a company to rent me a propane tank and they sent me a form asking for my Social Security Number. Is that a violation of Federal law?
HIPAA only governs the disclosure of electronic medical records. It has nothing to do with Social Security numbers, except to the extent that they appear in your electronic medical records. Generally speaking, there is no law against asking someone for their Social Security number. It is a request for information, protected by the First Amendment. Reciprocally, there is generally no law requiring you to disclose your Social Security number. Your choice not to speak is similarly protected by the First Amendment. A business can ask for your Social Security number, and you can want to keep it private. In that case, one of you can compromise to make a deal, or you can both walk away having lost nothing. There are, however, certain types of transactions for which a Social Security number is required under 31 CFR 1020.220. This includes setting up a bank account and transactions that have to be reported to the IRS. If you want to engage in one of these transactions without providing your Social Security number, you're out of luck.
Since you asked two questions: No and No Does a company’s T&amp;C or their house rules supersede law No and is asking private health status (including the request to wear a mask) an offence? No A company cannot require you to do things that are against the law but they can require you to do things that go further than the legal minimum. The UK and Spanish governments do not require you to wear a mask but they do not prohibit private organisations (like airlines) for making it a requirement to access their facilities. The law requires that they make reasonable accommodation for people with disabilities. But you don’t have a disability, you just can’t sleep with a mask on. If you had a disability you would have no trouble in getting a letter from your doctor to that effect. The contract requires them to take you from the UK to Spain: they don’t have to enable you to sleep. If you read the T&amp;C, you will find that they can refuse to carry you if, in their reasonable opinion, you pose a hazard to the aircraft or the people aboard it.
The First Amendment forbids the government from abridging your freedom of speech. There is no (federal) law against your private employer doing so. A good summary is https://www.americanbar.org/publications/insights_on_law_andsociety/15/winter-2015/chill-around-the-water-cooler.html
Health care providers in the US may send protected patient records to other health care providers for the purposes of treatment, either of the patient whose information it was or of a different patient (for instance, a doctor could send a chart of a different patient with a similar issue). This can be done without patient authorization, except for two cases: if the patient has requested more restrictions on use of their information and the provider agreed to those restrictions, and with psychotherapy notes. Source: HHS. WhatsApp specifically does not appear to be compliant with HIPAA, which is the US medical privacy law. However, there are many similar systems that are compliant. The body of your question asks about taking a smartphone screenshot; with many secure messaging systems, this is perfectly acceptable, and the principle of a doctor consulting with another doctor about a patient is actually encouraged. HIPAA violations do not by themselves result in any action against a medical license, nor can anyone besides the US government file suit based on a violation (everyone else is limited to complaining to the US government). Private lawsuits and (especially) license consequences are determined by state law, and are state- and situation-dependent. A doctor who calls a press conference to announce that this patient of his has HIV is more likely to face sanctions than a doctor whose violation was just not using a secure enough messaging client. HIPAA violations like this are not that uncommon, and generally result in at most a fine against the practice.
It's from a company called MarkMonitor that does trademark protection for clients - specifically around internet activities and that includes domain cybersquatting - which is illegal in the US under the ACPA, and of course that's what you were/are doing. So it could be a legitimate request as these things go. But that's not the whole story - the domain in the e-mail you posted is &quot;walmartt.com&quot; which is not only currently owned by Walmart Inc. but always has been, in fact the current Registrar of record is the aforementioned MarkMonitor. So either this isn't a legitimate request because you don't own &quot;walmartt.com&quot; and therefore this is spam or phishing (in which case feel free to delete it and move on with your life), granted that would be a pretty impressive bit of phishing since you are currently cybersquatting some Walmart-typo domains. Or you're just telling porkies all the way through your question for reasons of your own.
The employer may provide salary information, including a W-2, about an employee to an accountant, whether that accountant is also an employee of the employer, or an independent contractor hired by the employer. Normally a contract (or a company policy) will impose a duty of confidentiality on the accountant. If no such duty is explicitly imposed, there is quite likely an implied duty of confidentiality.
HIPAA does not legally protect physicians from disclosing PHI to another party, although there are a few exceptions: HHS provides an excellent resource on these, but the regulation most relevant to your question is Permitted Uses and Disclosures (5) Public Interest and Benefit Activities, which includes "Required by Law. Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders)." These statues, regulations, and court orders vary from state, but almost all of them refer to STDs and not genetic conditions (in some states, physicians are required to disclose positive STD test results to known sexual partners, but I can't find similar legislation for genetic tests). Here's an example of a voluntary patient information disclosure form – you'll notice that an individual has to specify the parties to whom they're willing to have PHI disclosed. The example you provided is still a violation of the Privacy Rule in the U.S., but this is a very curious grey area in bioethics and law. Disclosure of Genetic Information Within Families: How nurses can facilitate family communication. Gallo et al. Am J Nurs. 2009 Apr; 109(4): 65–69. (Emphasis mine.) HIPAA and Genetic Disclosure Does the law affect families? The privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) went into effect on April 14, 2003. The rule created new requirements for health care providers, third-party payers, and health care clearinghouses to protect the privacy and security of health information, including genetic information, that could identify a person. A person's decision not to disclose her or his risk of developing a genetic condition to a family member may pose a dilemma for the health care professional, who has to choose between ethical obligations to inform the at-risk party and legal requirements to respect and protect the patient's privacy. The potential for harm to family members often plays a large role in the decision. For example, in rare cases, the use of a certain surgical anesthesia can cause death in people with the mutation that disposes them to malignant hyperthermia. Likewise, strenuous exercise can bring on sudden death in people with hypertrophic cardiomyopathy. In such cases, clinicians should carefully explain the reasons for sharing information with family members, strongly encourage patients to notify at-risk relatives, and offer to help develop a plan for notifying them. When patients choose not to notify family members, clinicians typically respect the decision. There are situations, however, in which the clinician may consider overriding the patient's preferences because the family member is judged to be in danger of serious or immediate harm or there is a high likelihood that a dangerous condition will occur that can be either prevented or adequately treated with early recognition. Clinicians who believe it is necessary to override a patient's wish regarding the notification of family members, should consider consulting an ethics committee or legal council. In most situations, though, the risk of serious harm associated with nondisclosure is not clearly immediate. For instance, if a woman has tested positive for the BRCA1 or BRCA2 mutation but doesn't want to upset her two sisters by sharing that information with them, the need for disclosure isn't clearly urgent. Each sister has a one in two chance of carrying the same mutation. It would be understandable for the patient to try to learn more about what the mutation means for her and her children and to give careful thought to whether and how she'll share her test results with her sisters. Clinicians can best help family members by clearly informing patients who test positive for genetic conditions or the mutations that cause them about the risks faced by their family members, discussing the value of disclosure and offering assistance with it. The "Duty to Warn" a Patient's Family Members About Hereditary Disease Risks. Offit et al. JAMA. 2004;292(12): 1469–1473. (I can send you the full-text of this if you want it; it contains an excellent overview of cases and their outcomes relating to disclosing genetic information in the U.S. under HIPAA.) In general, the special nature of genetic tests has been viewed as a barrier to physicians' breaching the confidentiality of personal genetic information. However, the failure to warn family members about hereditary disease risks has already resulted in 3 lawsuits against physicians in the United States. While the findings of case law and the state and federal statutes that bear on the issue of "duty to warn" of inherited health risk are still being defined, we believe that health care professionals have a responsibility to encourage but not to coerce the sharing of genetic information in families, while respecting the boundaries imposed by the law and by the ethical practice of medicine. ...in considering whether to breach patient confidentiality to warn of risks of a genetic disease, clinicians need to balance the actual risk of that disease, the efficacy of potential preventive interventions, as well as emerging legal considerations and potential liabilities. Overriding patient confidentiality and genetic privacy might very well mean violation of HIPAA and certain state regulations, with attendant civil or criminal liability. At the same time, in one state appellate court decision that has not been overturned, the estate of a physician was held liable for his failure to warn relatives of hereditary disease risk.
I think this shows a misunderstanding of the meaning of the GDPR. A data subject has the right to demand information, correction, deletion etc. about some of their data held by some institutions, depending on the legal basis for the data processing. One John Smith does not have the right to see the data of any other data subject named John Smith, and he cannot even demand to know if there are other John Smiths in the database. The data controller has to make reasonable steps to ensure that an individual who seeks account information is in fact the individual who is the data subject. In the case of an email, that's usually easy -- if John Smith can access the mail account jsmith@sample.org, one can assume that he is the John Smith who opened the account. If not, then not. If the data controller has the birthplace and birthdate in their records, they can possibly match that against some government-issue identity document, too, but why would they have that data?