Are partner notification laws in conflict with HIPAA? HIPAA (Health Insurance Portability and Accountability Act) requires health care providers only share medical information with family members under the patient's consent. However regarding HIV/AIDS many states make it compulsory to notify sexual partners and / or needle-sharers of the diagnosed. (Source: CDC) Are they in conflict? Can anyone refuse to disclose to partners his HIV status by HIPAA?
No. HIPAA places no limits on who you may share your medical records with - only on those with who your doctors (et al) can share. The HIV laws you refer to, place a positive obligation on you to share the information.
No To declare that a parent is &quot;unfit&quot; in the US requires at least a decision by a government agency (often called &quot;child protective services&quot; or &quot;child welfare&quot; depending on the state) usually confirmed by a judge. Medical testimony may be persuasive, but neither doctors nor hospitals may make such determinations.
Certainly. A phone number is personal information (and on top of that, WhatsApp may provide some &quot;profile info&quot; from the people you contact). It is not difficult to identify a person by its phone number. So, sharing the phone number of the people affected should take into account the restrictions of GDPR. For instance, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) established in its Resolution R/03041/2017 that the Town Hall of Boecillo had violated the GDPR because it had created a WhatsApp group of citizens. Those citizens had provided their phone numbers to be informed about town hall activities, but they had not agreed to share their numbers with the other members of the group. And that was a very generic group. Doing a &quot;patients recovering from cancer&quot; or &quot;drug abusers under treatment&quot; or &quot;people who need food assistence&quot; group would involve sharing personal information that gets the maximum protection (in some specific instancies it could be that your information sharing that information is illegal even if the users gave you full consents). So yes, creating a WhatsApp group could very easily lead to a GDPR violation, and in fact it has been ruled at least once that it has. The fact that people cannot send messages is irrelevant. It would not make the issue any better or worse. After all, if I send a message through WhatsApp I am implicitly giving permission to everyone in the group to read it.
Any written communication is generally admissible Subject to all the normal rules for admissibility of course. For texts between you and a third party the major issue that springs to mind is relevance. As in, how are they relevant to the dispute between you and this man? If they are not, your lawyer should have objected to them on this basis, however, its too late now. I'm curious as to how he obtained these and whether it was done legally or not. Illegality will not affect their admissibility as the exclusionary rule doesn't apply to civil matters, however, it does speak to the gentleman's character.
I know of no laws at the federal or state level that explicitly extend their protection to poly relationships. However, any law that purports to outlaw a polyamorous relationship among consenting adults should be looked at very skeptically, as it would likely be found unconstitutional under Lawrence v. Texas, 539 U.S. 558 (2003): The case does involve two adults who, with full and mutual consent from each other, engaged in sexual practices common to a homosexual lifestyle. The petitioners are entitled to respect for their private lives. The State cannot demean their existence or control their destiny by making their private sexual conduct a crime. Their right to liberty under the Due Process Clause gives them the full right to engage in their conduct without intervention of the government. While that case dealt with homosexual relationships, it seems unlikely that the courts would conclude that heterosexual couples, throuples, etc., are entitled to less protection. Adultery laws exist in many jurisdictions, and many of them have survived constitutional challenges. But as far as I know, all those challenges relied on legal principles and precedents -- in particular, Bowers v. Hardwick, 478 U.S. 186 (1986) -- that Lawrence explicitly overruled. In this regard, I would not expect anyone in a polyamorous relationship to encourter meaningful legal jeopardy as a result of that relationship, assuming that the relationship(s) were otherwise legal and out in the open. If A is unaware of her spouse's relationship with C, for instance, that could cause problems in a divorce proceeding. I don't know of any legal options specifically designed for this sort of arrangement, but the more interconnected and interdependent these groups are, the more likely it becomes that some sort of written agreement would become worthwhile -- not as a response to legal danger arising from the polyamorous nature of the relationship, just to address the fact that someone is eventually going to fall short, potentially causing problems for the whole group. There are many lawyers who specialize in LGBT issues, and I'd imagine that some of them would be able to provide more detailed advice about how to deal with this type of situation.
Yes, GDPR applies: you are a data controller established/living in the UK or are offering services to people in the UK you fall under the material scope of the GDPR. The Art 2(2)(c) exemption for “purely personal or household activity” does not apply since you're offering the service to the public. You must consider GDPR compliance here. This is especially important as you are showing personal data to the public. Don't do that unless you have a very good reason, appropriate safeguards, and are clear to users how their information will be shown. On a high level, GDPR compliance involves working on the following questions: For what purpose are you processing personal data? Context: purpose limitation principle per GDPR Art 5(1)(b) What is the legal basis for processing? GDPR Art 6(1) lists the available legal bases. Here, consent, necessity for performance of a contract, or a legitimate interest could be a legal basis. They may have further obligations attached. A legitimate interest requires a balancing test that considers the data subject's rights and freedoms. Consent must fulfil the conditions per Art 7 in order to be valid. What is the minimal data necessary to achieve the purpose? Per the Art 5(1)(c) data minimisation principle, it is illegal to process personal data beyond what is necessary and adequate. You must provide data protection by design and by default per Art 25. Special categories of data per Art 9 such as health data are illegal to process outside of narrow exemptions. You must delete data once it is no longer necessary. What appropriate safeguards and security measures should you apply? Per Art 24 and 25, you are responsible for determining and implementing appropriate measures. This depends a lot on your specific context, so there's no checklist you can apply. Per Art 25(1) you must pseudonymize the processed information if that is compatible with the processing purpose. What further compliance measures do you have to consider? There are additional GDPR and non-GDPR compliance measures. From the GDPR side: Use the answers to these questions to write a privacy policy, including the information that you must provide to data subjects per Art 13. Consider whether you have to maintain a Records of Processing document per Art 30, or if you have to make a Data Protection Impact Assessment per Art 35. If you use third party services, figure out whether they are a joint controller or data processor and apply appropriate safeguards. If you have data processors, ensure that you have a contract in place that covers the items from Art 28(3). If you share data with other controllers (not processors) you need a legal basis for doing so. If you transfer data into a non-EU/EEA country (after 2020: non-UK country) you need a legal basis per Art 44 and have to cover additional items in your privacy policy. Ideally, the target country is covered by an EC adequacy decision per Art 45. For US-based companies, this is the case only when they have self-certified under the Privacy Shield framework. Non-GDPR compliance steps could include cookie consent banners, or showing a VAT ID. How can you prepare for data subject requests? Data subjects have various rights per Arts 15–23, subject to the modalities in Art 12. For example, a data subject could request that their information is erased from your website. The exact rights also depend on the legal basis you selected. You should figure out in advance how to deal with such requests.
Does the HOA's lawyer have a duty or is it standard practice to label documents (including) as privileged if it contains privileged information? While it is sometimes labeled, this is done by attorneys when it is done, mostly to prevent stupid clients from sharing the information and waiving the privilege. Usually, however, documents are not marked as privileged in advance and when documents are requested from a third-party this analysis is usually done by junior attorneys and paralegals working as a team for the first time. Formal designation is not required because the definition of what is protected is defined by statute and common law rules on a uniform basis. The duty to share information with HOA members does not generally extend to privileged information. If a document that would otherwise be required to be disclosed (like attorney invoices) contains privileged information, the usual course of action is to redact the invoice so that it contains only non-privileged information (e.g. a bottom line amount owed and the date of the invoice and the matter). In an HOA context, the privilege of the HOA as a client belongs functionally to the board and its officers, not to all of the members of the HOA. Does the Association's contractor who maintains the records have a duty to act as a gatekeeper to said invoices if they are not labeled? This depends upon the contract between the Association and the contractor. A well written contract would include this duty, and spell out the mechanics of how it is implemented, but not all contracts live up to best practices. A related issue is whether a release of privileged information by an independent contractor constitutes a waiver of the privilege by the client if the contractor is not in an agent-principal relationship with the Association, which is often a determination made only after the fact by a court. Some jurisdictions' rules of civil procedure provide a waiting period between the issuance of a third-party subpoena for documents and the earliest time that those documents can be delivered to a third-party, to allow objections on grounds of privilege or another basis to be raised prior to the disclosure of the documents. Colorado Rule of Civil Procedure 45, for example, has such a provision. I don't know what the rule is in Florida on that issue.
The nature of the meeting matters: I assume this is a private meeting, not a public meeting. Under RCW 9.73.030, you have to announce that the meeting is being recorded (the announcement must itself be recorded), or the recording device must be obvious. There is no exception regarding property status (such as &quot;on school property; in a government-funded facility&quot;). But it also matters if the conversation is &quot;private&quot;. See State v. Townsend, 57 P.3d 255, which gives weight to the subjective intent of the parties, thus the primary question would be whether the school official intended the communication to be private. Given strong FERPA privacy protection of personal information about students and in light of the likely nature of the conversation, one might think that the administrator intends the discussion to be private. However, the administrator cannot discuss e.g. disciplinary issues with third parties, so that would not be a valid basis for expecting privacy. You would really need to get a lawyer, discuss the expected subjects with the lawyer, and see if there is a reasonable expectation of privacy (even if this is not a public meeting). Your local ACLU chapter might advise you of your rights, though they would probably also advise you to not experiment with breaking the law (I don't see what legitimate purpose would be served by recording in secret).