How to report an infraction of the HIPAA requirements? In the United States, in accordance with HIPAA requirements, the lab who performed a blood test on a patient are required to send the results to the patient no later than 30 days from the date of patient's request. A patient requested multiple times their results (face-to-face during the blood test day, then by phone and emails). The lab eventually sent the patient the full results 3 months after the blood test, i.e. 3 months after first requested their results. Where can the patient report this infraction of the HIPAA requirements? If the answer is state-dependent, I'm mostly interested in California and Massachusetts. https://myquest.questdiagnostics.com/web/help/Content/labresults.html: The U.S. Department of Health and Human Services (HHS) ruling, effective April 7th, 2014, allows patients in all states to have access to their lab results directly from Quest Diagnostics within 30 days. http://www.modernhealthcare.com/article/20140203/NEWS/302039958 Under the new rule, labs will be required to provide patients copies of their lab test results within 30 days of a request.
Where can the patient report this infraction of the HIPAA requirements? You file a complaint with the Office for Civil Rights (OCR). If you believe that a covered entity or business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security or Breach Notification Rules, you may file a complaint with OCR. OCR can investigate complaints against covered entities and their business associates. The U.S. Department of Health &amp; Human Services website for complaints is: http://www.hhs.gov/ocr/privacy/hipaa/complaints/. From there you can file the complaint either electronically via the OCR Complaint Portal, or on paper by mail, fax, or e-mail. The language from the Final Rule (CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports) that describes enforcement is section V part L: Comment: Commenters asked whether a laboratory could be subject to penalties for charging more than the reasonable cost-based fee allowed by the Privacy Rule, for failing to comply with an individual's request for completed test reports within the appropriate time period, or for failing to comply with an individual's request altogether. Response: HIPAA-covered laboratories that fail to comply with the Privacy Rule's access provisions are subject to an enforcement action for noncompliance by the Department, which may include the imposition of civil money penalties. Walkthrough to file a complain through the OCR Complaint Portal (which is linked on http://www.hhs.gov/ocr/privacy/hipaa/complaints/), in the case mentioned in the question: Done!
HIPAA only governs the disclosure of electronic medical records. It has nothing to do with Social Security numbers, except to the extent that they appear in your electronic medical records. Generally speaking, there is no law against asking someone for their Social Security number. It is a request for information, protected by the First Amendment. Reciprocally, there is generally no law requiring you to disclose your Social Security number. Your choice not to speak is similarly protected by the First Amendment. A business can ask for your Social Security number, and you can want to keep it private. In that case, one of you can compromise to make a deal, or you can both walk away having lost nothing. There are, however, certain types of transactions for which a Social Security number is required under 31 CFR 1020.220. This includes setting up a bank account and transactions that have to be reported to the IRS. If you want to engage in one of these transactions without providing your Social Security number, you're out of luck.
Your basic regulatory umbrella for anything that stores, transmits or interacts with any private health information or health IT systems is Health Information Privacy | HHS.gov, as well as state authorities. There are severe penalties at the federal and state level for non-compliance and privacy breaches, and many other agencies - such as the DEA, state health departments, insurance companies - would have to be involved in testing and certification of such a App. You will simply not be able to distribute the App on Google or iTunes without their approval, and those distributors will not approve a App that has not been strictly vetted for privacy and HIPAA compliance. In order to distribute such as App - with a TOS that assures personal privacy and shields you from liability (if possible) - you will need to spend hundreds of thousands of dollars on legal representation for compliance. As an example, see ohwilleke's answer to What kind of lawyer should I seek to understand compliance requirements for processing credit cards?
Some United States Supreme Court rules are helpful, though these rules are not stated as applying to any other court. Timeframe The brief must be submitted within a certain time period, depending on the case at hand: An amicus curiae brief in support of a petitioner or appellant shall be filed within 30 days after the case is placed on the docket or a response is called for by the Court, whichever is later, and that time will not be extended. An amicus curiae brief in support of a motion of a plaintiff for leave to file a bill of complaint in an original action shall be filed within 60 days after the case is placed on the docket, and that time will not be extended. An amicus curiae brief in support of a respondent, an appellee, or a defendant shall be submitted within the time allowed for filing a brief in opposition or a motion to dismiss or affirm. An amicus curiae shall ensure that the counsel of record for all parties receive notice of its intention to file an amicus curiae brief at least 10 days prior to the due date for the amicus curiae brief, unless the amicus curiae brief is filed earlier than 10 days before the due date. Format The brief must be submitted electronically and in print: An electronic version of every amicus curiae brief in a case before the Court for oral argument shall be transmitted to the Clerk of Court and to counsel for the parties at the time the brief is filed in accordance with guidelines established by the Clerk. The electronic transmission requirement is in addition to the requirement that booklet-format briefs be timely filed. Wikipedia claims that the brief must be submitted as a printed book in forty copies, but I can not substantiate that within the Supreme Court rules - which is the document cited! Other briefs are required to be submitted in print in forty copies, so such a requirement would not be overly surprising, but I don't know if this is true. This states more requirements for general courts: 1) if the amicus curiae is a corporation, a disclosure statement like that required of parties by Rule 26.1; (2) a table of contents, with page references; (3) a table of authorities—cases (alphabetically arranged), statutes and other authorities—with references to the pages of the brief where they are cited; (4) a concise statement of the identity of the amicus curiae, its interest in the case, and the source of its authority to file; (5) unless the amicus curiae is one listed in the first sentence of Rule 29(a), a statement that indicates whether: (A) a party's counsel authored the brief in whole or in part; (B) a party or party's counsel contributed money that was intended to fund preparing or submitting the brief; and (C) a person—other than the amicus curiae, its members, or its counsel—contributed money that was intended to fund preparing or submitting the brief and, if so, identifies each such person; (6) an argument, which may be preceded by a summary and which need not include a statement of the applicable standard of review; and (7) a certificate of compliance, if required by Rule 32(a)(7). Length There is a length limit: Except by the court's permission, an amicus brief may be no more than one-half the maximum length authorized by these rules for a party's principal brief. If the court grants a party permission to file a longer brief, that extension does not affect the length of an amicus brief. Timeframe There is also a slightly different timeframe: An amicus curiae must file its brief, accompanied by a motion for filing when necessary, no later than 7 days after the principal brief of the party being supported is filed. An amicus curiae that does not support either party must file its brief no later than 7 days after the appellant's or petitioner's principal brief is filed. A court may grant leave for later filing, specifying the time within which an opposing party may answer. In addition to all of this, a guide to filing amicus curiae briefs can be found here. It should, of course, only be used as a basic introduction to the briefs.
The Fifth Amendment would not apply, because nothing in the testimony would incriminate the doctor. Indeed nothing would be at all likely to incriminate the President either, it is not a crime to be unable to carry out Presidential duties. It is likely in such a case that the President would waive confidentiality. In that case the doctor could testify freely. If the President insisted on confidentiality, and attempted to prevent the doctor from testifying to Congress, there would be a conflict between the power of Congress to compel testimony, in this case on what is clearly a vital national issue within the scope of the needs of Congress, and traditional doctor-patient confidentiality, let alone the requirements of HIPAA. I am not sure how this conflict would be resolved. There might be an emergency application to the Supreme Court, but the SC does not usually do very well with truly urgent issues. The Pentagon Papers case and Bush V. Gore indicate some of the problems that can arise. If the doctor was prevented from testifying, that might incline members of congress to think the testimony would not be favorable to the President, and thus tend to suggest that they should not approve the President resuming or continuing his or her powers and duties. But that is rather speculative. The 25th has never been invoked, and the detailed procedure that would be followed if it were is not very clear. I am not aware of any similar situation in which medical testimony has been demanded to deal with an urgent issue, but the patient has attempted to block it. I think this case must be considered to be undecided until it actually arises and a court rules.
Where is this 3 day compromise coming from? The three (business) day requirement is statutory, and can be found in 18 U.S. Code § 922: (A) before the completion of the transfer, the licensee contacts the national instant criminal background check system established under section 103 of that Act; (B) (i) the system provides the licensee with a unique identification number; or (ii) subject to subparagraph (C), 3 business days (meaning a day on which State offices are open) have elapsed since the licensee contacted the system, and the system has not notified the licensee that the receipt of a firearm by such other person would violate subsection (g) or (n) of this section, or State, local, or Tribal law; and [...]
By default a new US Federal law is effective as soon as it is enacted. That is, when the President signs it, when the 10 days for approval expire without the President vetoing it, or on the date when the second of the houses of Congress votes to override a veto. However, in modern usage, many, perhaps most, statutes specify as pone of their provisions an effective date some time after the date of enactment, in some cases several years later. If such a date is specified, that is the legal date. All bills and the actions enacting them are recorded in the Congressional Record, which is a public document, published on a regular basis. They are generally included in the next revision of the USC (united States Code) and the USCA (United States Code, Annotated). But these publications are generally well after the date of enactment. The Thomson Reuters Perspectives: Teaching Legal Research and Writing (winter 2000) “HOW Can I Tell the Effective Date of a Federal Statute?” by Barbara Bintliff says: The generally applicable rule is easy to state: a federal statute usually takes effect on the date of its enactment,3 which is itself determined by when the last step necessary for the statute’s enactment occurred. Most of the time the last step in the enactment process is the president’s signature, and this date, therefore, becomes the date of effectiveness for most federal statutes. However, there are exceptions to the general rule. For instance, sometimes the last step occurs when Congress overrides the president’s veto, or when the bill is allowed to become law without a presidential signature. And sometimes a later date is specified by the terms of the statute itself. The article geos on to say: The date of enactment is most easily located by consulting the parenthetical information provided after every statutory section included in the print and online versions of the United States Code (USC), the United States Code Annotated® (USCA®), and the United States Code Service (USCS).5 The parenthetical is variously called a “source note,” “statutory authority,” “statutory history,” “history,” “source credit,” or “credit.” In the print versions, the parenthetical follows the statutory section with nothing in between the statutory text and the source note. In the primary online versions, it is labeled “credit” (in USCA on Westlaw) or “history” (in USCS on LEXIS-NEXIS). The credit has been included with federal statutes since they were first codified in the Revised Statutes of 1874 and is an official part of the statute. "Enactment of a Law - Learn About the Legislative Process" from Congress.gov describes the procsss also, saying: If the president does approve it, he signs the bill, giving the date, and transmits this information by messenger to the Senate or the House, as the case might be. In the case of revenue and tariff bills, the hour of approval is usually indicated. The enrolled bill is delivered to the archivist of the U.S., who designates it as a public or private law, depending upon its purpose, and gives it a number. Public and private laws are numbered separately and serially. An official copy is sent to Government Printing Office to be used in making the so-called slip law print. ... If a bill which has been vetoed is passed upon reconsideration by the first House by the required two-thirds vote, an endorsement to this effect is made on the back of the bill, and it is then transmitted, together with the accompanying message, to the second House for its action thereon. If likewise reconsidered and passed by that body, a similar endorsement is made thereon. The bill, which has thereby been enacted into law, is not again presented to the president, but is delivered to the Administrator of the General Services Administration for deposit in the Archives, and is printed, together with the attestations of the secretary of the Senate and the clerk of the House of its passage over the president's veto.
Presumably you consented to have an x-ray. It is a reasonable assumption that it was not your intention to simply be given the films without interpretation by a radiologist. If that was your intention then the obligation would be on you to make that clear since it is so far from ordinary practice that no reasonable person could know that. To use your analogy it would be like you asking to have your window washed but not wanting to have the soapy water rinsed off afterwards (assuming these were separately billable services). Further, rights and obligations under contracts are transferable by default. So it is perfectly legitimate for the lab to outsource the radiography without having to ask you.