Is it a HIPAA violation for a dentist office to print a patient&#39;s password on paperwork? Dentist office just printed my password (to their portal) on their paperwork. Surely this is a HIPAA violation (or against best practices, HIPAA or otherwise). Can anyone confirm if so and point me to any resources? I have looked independently but am unclear.
This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth filled (not that "somebody had a tooth filled"). Protected information can be revealed to certain people, such as the lab that they send samples to, or your insurance company. This is covered by what is known as "The Privacy Rule". There is a related rule, the Security Rule, which essentially says "you need to keep information safe". An example of a required security rule standard is that the provider must Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored HHS recommends degaussing, but other means of satisfying the rule exist (burning, dissolving in acid). Tossing in the trash would not satisfy the rule. Password management falls under the weaker category of "addressable", that is, a provider needs to think about how they will manage passwords, but there is no specific requirement regarding what you have to do (unlike the requirements of Data Backup, Written Contract. Incident Reporting or Media Disposal). Printing and distributing to customers your account and password would, on the other hand, be a reportable incident. Information about your name, the dental procedure done, and the cost of the procedure, is probably also on the paperwork that they give you, and that even more than your password is protected information. A provider is allowed, indeed required, to disclose protected information to the patient. The assumption is that once you have processed that information, you will destroy or protect the paperwork, as you see fit.
First of all, a contract is valid without a signature and even without being in writing; all that is needed is consent by the parties. Therefore, the signature is merely evidence of that consent and is only relevant if a dispute arises over the general consent or the particular terms that were consented to. A digital signature would make it harder for Bob to argue that those were not the terms he signed but if I have Bob's signature on them then the onus of proving he didn't sign rests with Bob, I don't have to prove he did. All of the methods you suggest are valid as would an email saying "Got the contract. I agree. Bob."
Firstly: that depends on the jurisdiction. It might not even be possible at all for employers to attempt to sue their own employees for damages caused by negligence. Even terminating an employment contract for reasons of negligence is quite difficult in many jurisdictions. Second, if it is possible, the question is wether such legal proceedings could be expected to be successful. Employees making mistakes is part of the risk of doing business, and distinguishing a "mistake" from "negligence", "gross negligence" , or "intentional wrongdoing" by the employee ought to place quite a burden of proof on the employer. To be held negligent in the first place, the employer will have to to prove that the employee was aware of the fact that the password they used was common, well-known and extremely insecure. Knowledge of which passwords are common and well-known is, unless you are considered a skilled IT security professional, not something that a typical employee can reasonably be expected to know. Before there can be a case for negligence by the employee, the employer needs to make a strong case that: either the employee is that skilled IT security professional that really should have know better or the company can demonstrate that they provide all employees with adequate instruction and security training that includes how to select good passwords and which bad ones to avoid and that they seriously ensure both awareness of their password and security policies and compliance. even then, not enforcing a good password policy in your IT systems and assigning or allowing users to select weak passwords is in itself already negligent...
Let’s work it through Is the work copyright? Yes. Are you making a copy or a derivative work? Yes. Do you have permission? No. At this point, it is prima facie copyright violation. However, various copyright laws have defences for breach. You don’t say where you are but as the USA is the most permissive in this regard we’ll use the USA. If it’s not legal there, it’s not legal anywhere. If it is legal there, it’s still likely to be not legal everywhere else. is it fair use? Almost certainly not. Wizards of the Coast (the copyright owner) already do this. While this service is free for creatures from the Monster Manual, it does drive traffic to their web site where they sell stuff. They also licence (presumably for money) others to do the same. Your usage would negatively affect the copyright owners market. This counts against fair use. Because it’s already being done, your work has virtually nil transformative value. This counts against fair use. You are copying a substantial part of the work. This counts against fair use. You are not using it commercially but neither is it for educational use. This is unlikely to matter. On balance: not fair use. TL;DR This is copyright violation.
Late to the party, but I'll answer anyways. In general, providers have a lot of wiggle room when sharing information with parents, on condition that the patient hasn't explicitly objected despite having opportunity to do so. HIPAA allows the provider to make a judgment call on whether such information can be shared without explicit consent: Quoting Title 45 § 164.510 : (i) Obtains the individual's agreement; (ii) Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or (iii) Reasonably infers from the circumstances, based the exercise of professional judgment, that the individual does not object to the disclosure. HHS does discuss disclosure to family members in their FAQ : A covered entity is permitted to share information with a family member or other person involved in an individual’s care or payment for care as long as the individual does not object. A parent of a child who has just turned 18 is likely still somewhat involved in the child's care, so, absent either an objection or a reason to believe the child would object if asked, sharing is probably not a violation.
How does GDPR work with insurers in relation to refusing information about pre-existing medical conditions? Due to it being special category data. As in, which of the "conditions for processing special category data" would apply? As far as I see, Article 9 (a) ("explicit consent") would apply. So the insurer would have to ask the customer for consent. My first thought was it would be consent-based (condition a), but under consent, it is noted that you should avoid making consent a precondition of service. Yes, that is often noted, but that is only partially true. The GDPR actually says (Article 7, emphasis mine): When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. So making consent a precondition of service can be ok, provided that the data is "necessary for the performance of that contract". Whether knowing about preexisting conditions is "necessary" for an insurance provider is something a court would have to decide, but on the face it does not seem unreasonable. Source: General Data Protection Regulation
There aren't any specific laws or regulations about medical charges. Instead, this is a matter of general contract law, where you have to agree. You have to consent to be treated, and a signature is taken to be evidence of consent. The law does not say that they have to ask permission for absolutely everything they do, the action just as to be in accordance with an accepted standard of medical practice among members of the medical profession with similar training and experience in the same or similar medical community as that of the person treating, examining, or operating on the patient for whom the consent is obtained This law insulates doctors from getting sued. In a situation where treatment is provided against a patient's instructions, you may have a cause of action for e.g. battery. In general, a doctor can't poke you, draw blood, make "offensive contact" etc. without consent, and consenting to one procedure does not "open the floodgates" of consent for any othre procedure. Of course, if the procedure was not performed, you obviously are not liable for the cost (and they are not liable for a non-occurring battery). This may in fact constitute gross negligence. During trial, the primary issue is likely to be whether there is proof that the procedure was expressly rejected. The doctor would probably provide the consent form, and that form may or may not indicate that the test would be conducted. It would not be surprising if the patient never saw an actual form and instead just electro-signed, having been told that this is authorization to treat. Corroborating witnesses would be helpful. From a practical perspective, especially if the billing department is being recalcitrant, this is probably a matter best handled by an attorney who would start with a formal letter summarizing the consequences of unauthorized medical treatment.
I'm wondering whos responsible for this code if people start using it? The user. Can the people using it that think its under GPL in any way get in trouble for it or be made to remove it from their projects? Yes, they can be sued (successfully) for copyright violation. It’s not enough that you think you have permission from the copyright holder - you actually have to have permission. The law places the onus on the copier to seek out and get permission from the copyright holder. In theory, someone deceived in this way could sue the repo poster(s) for misrepresentation, however, there are practical issues about finding them, having them in an accessible jurisdiction and if they are judgement proof. Copyright law was created to protect physical books and paintings - it doesn’t really fit with digital methods of reproduction but it is the law. It doesn’t matter that complying with it can be hard bordering on impossible - comply with it you must.