Does HIPAA apply to individuals? Does HIPAA privacy protection apply to an individual who has no relation to the healthcare field? For example, my neighbor drops his prescription pill bottle on the sidewalk outside his house. I pick it up and return it. Would me telling someone else about his prescription be a HIPAA violation or just a jerk move?
It would merely be a &quot;jerk move&quot;. HIPAA only applies to &quot;covered entities&quot;: Healthcare Providers Health Plans Healthcare Clearing Houses (i.e. Paying for your health care) Business Associates of the Above) Source: CDC page on HIPAA
A trust, revocable or irrevocable, does not protect the estate from claims by creditors. Under ORS 115.125(1)(k), the Department of Human Services or the Oregon Health Authority has a claim against the estate, behind the claim for "the state’s monthly contribution to the federal government to defray the costs of outpatient prescription drug coverage provided to a person who is eligible for Medicare Part D prescription drug coverage and who receives benefits under the state medical assistance program or Title XIX of the Social Security Act" (which is item (j)) and ahead of only the claim by the Department of Corrections for care and maintenance of any decedent who was at a state institution – that one is dead-last in the list of statutorily-listed claims.
The primary legal question is whether the resident (tenant) has breached a duty of care. There are all sorts of laws establishing duties of care, such as between doctor and patient, which may be created by a legislature or may be part of common law tradition. There is a duty of care imposed on a landlord w.r.t. the tenant, requiring that the premise be &quot;secure&quot;, therefore a landlord might easily be held liable if the main door into the building was not locked. This duty is a specific instance of a general duty from tradesman/businessman to customer. As far as I can determine, there is no such statutory duty imposed on tenants in Washington state, and none from case law being revealed by a few cursory searches. In order to be subsumed under general &quot;everybody has a duty to everybody else&quot; law, the damage would have to be foreseeable. It is said that &quot;If something is foreseeable, it is a probable and predictable consequence of the defendant’s negligent actions or inaction&quot;. This mean that a reasonable person would have known that, under the circumstances, the damage is likely to result. Circumstances vary quite a bit, and there is no general rule about holding the door open for another person. If there is abundant signage reminding tenants to never ever let in a stranger no matter that their excuse and/or if the premise is in a crime war-zone, the outcome is more likely to be considered to be foreseeable.
It is legal for you to publicly distribute your medical records, and it is legal for you to publicly distribute your bills. Defamation would be a concern only if you make a false statement that does harm to someone. A medical bill is a statement made by someone else (in both senses of &quot;statement&quot;).
Under 45 CFR 164.402 a "breach" is the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information. Disclosing PHI to random people is not permitted under subpart E. Then then allow that it can be deemed to not be a breach if they can "demonstrate[] that there is a low probability that the protected health information has been compromised based on a risk assessment of certain factors – there isn't any clear yes/no rule as to how you could say that disclosing PHI is not a breach. If they discover a breach, they must notify the affected individual. One ploy would be for them to stick their heads in the sand and be careful to not discover: but §164.404(2) says A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity So if, for example, they had been told that person X has moved, a reasonably diligent person would know that sending PHI to the old address will result in a breach. The Sec'y of HHS must also be notified of the breach, though this can go in the annual report if the breach involves fewer than 500 people. The affected individual can also file a complaint with HHS.
There is no general law requiring a doctor to report to the government that they have given medical treatment. On the contrary, there is a federal rule (the "Privacy Rule") that somewhat requires keeping medical information private. There may be certain instances where a report must be made, such as the obligation to report gunshot wounds or suspected child abuse. There could be entanglements regarding use of drugs that require a prescription, where there is a required paper trail.
You can read about the obligation to access public records under Kentucky law here. This page is the Louisville PD' statement about what is available. They state that &quot;Some items have been redacted, blurred or withheld for privacy or legal reasons&quot;, noting for example that the statute &quot;exempts from disclosure under the Open Records Act information that, if disclosed, would create an unwarranted invasion of personal privacy. Any further reference to redactions for personal privacy /concerns is also made pursuant to this law and/or HIPAA&quot;. The plaintiff's filing is not available and the police department has not commented, so we don't know exactly what is being demanded. However, the PD has not claimed that they are withholding the requested records for legal reasons, and the media alleges that the suit alleges that the PD lied about the existence of said records (note the double allegation). Body-worn cameras are specifically included here, and this part says that you can sue in county court. FOIA does not apply, because the Lousiville PD is not an agency of the US government.
BAD idea It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook. It isn't a fair use of the phonebook pictures - and you might not have a license anyway, as some people associate photos with numbers that they don't have a license to associate with anyway. But what if instead of a photo of the person, the first photo someone associated with the person is a photo of something like... crack cocaine, a photo of someone in a very compromising situation, just genitals, or some other thing that is just as tasteless or possibly criminal to share? In that case, your company is possibly committing defamation, and in case sharing or possessing of the image itself is illegal, your company is now the actor and liable. Depending on the content of the picture, distribution of pornographic material (possibly even underage material of that sort) could be up that alley just as much as hate speech through symbols, usage of banned symbols (such as swastikas in Gernamy) and many many others.