Does HIPAA protect against doctors giving prescriptions to pharmacists that you didn&#39;t approve? My doctor sent a prescription to a pharmacist his clinic had a relationship with. I didn't approve this transaction. Is it legal for him to share my prescription with a pharmacist I didn't approve? I gave him the name of the pharmacist I wanted to use, and they disregarded that. Is this a violation of HIPAA?
It is not a violation. The privacy rule requires that your personal medical information be kept &quot;private&quot;, but your consent is not required for another health care provider to process PMI. For example, your consent is not required to send samples to a particular lab for analysis, your consent is not required for the doctor to consult with a specialist. The primary health care provider can disclose information to a business associate, who is bound by the same privacy rule, the result being that your PMI cannot be &quot;generally published&quot; because disclosures are only allowed to those who are bound by the privacy rule (or, to whom disclosure has been authorized by the patient, e.g. to a relative).
The section you quote as clearly saying a thing is not clearly saying the thing. However: you cannot pass on or resell any license keys seems to say a thing clearly. However, one could argue that it's the sharer of the account who is in the wrong, and not the person receiving and passing on the account. I'd say that that piece of the agreement, combined with this: must not... let other people get access to anything we've made in a way that is unfair or unreasonable says that, yes, they are out of bounds.
The FDA approved the device as requiring a prescription (not OTC). FDA regulations govern the manufacture or distribution of devices and drugs, not the consumption. An overview of FDA regulation is here. They say they they are "responsible for regulating firms who manufacture, repackage, relabel, and/or import medical devices sold in the United States". The entire pile of regulations (21 CFR) is here. There has to be an underlying statute that authorizes the FDA to impose restrictions: that would be in Title 21 of the US Code. The specific law regulating medical devices is 21 USC 360. Congress can easily pass laws that restrict what businesses do (a consequence of the Commerce Clause of the Constitution), but they (theoretically) have a more limited ability to restrict what an individual does. Since there is no federal law prohibiting the use of a prescription device, it is not a crime to possess or use such a device.
34 CFR Subpart D covers this topic ("Under what conditions is prior consent not required to disclose information?"). This includes The disclosure is to other school officials, including teachers, within the agency or institution whom the agency or institution has determined to have legitimate educational interests so that raises the question of whether there is a legitimate educational interest. Additionally, the question is raised as to the status of an SRO (they are not teachers). Disclosure is allowed to A contractor, consultant, volunteer, or other party to whom an agency or institution has outsourced institutional services or functions may be considered a school official under this paragraph provided... the conditions being that the person Performs an institutional service or function for which the agency or institution would otherwise use employees; Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and Is subject to the requirements of §99.33(a) governing the use and redisclosure of personally identifiable information from education records I would take this model memorandum as the most likely agreement, though your district may have a totally different memo where SROs are purely security guards. An SRO is to advance the program objective which include "Education of children regarding the role of laws, courts, and Police in society", which is the hook into "legitimate educational interest". This nothwitstanding the part that says that they "are police officers and not school teachers, school administrators, nor school counselors. The officers will assist teachers with classroom presentations on relative topics when requested and able" (there is no principle that only teachers, administrators, or counselors can have a legitimate educational interest). This model memo does not say anything that indicates that the conditions "Is under the direct control" and "Is subject to the requirements of §99.33(a)" are true, but those conditions could be satisfied external to the MOU. There are some additional exceptions of the "if required by law" type, such as a state law "adopted before November 19, 1974, if the allowed reporting or disclosure concerns the juvenile justice system and the system's ability to effectively serve the student whose records are released"; or, after that date, is "subject to the requirements of §99.38" which refers you to §99.31(a)(5)(i)(B). If that is confusing, here are the two self-referring sections: §99.38(a) If reporting or disclosure allowed by State statute concerns the juvenile justice system and the system's ability to effectively serve, prior to adjudication, the student whose records are released, an educational agency or institution may disclose education records under §99.31(a)(5)(i)(B). §99.31(a)(5)(i)(B). The disclosure is to State and local officials or authorities to whom this information is specifically...Allowed to be reported or disclosed pursuant to State statute adopted after November 19, 1974, subject to the requirements of §99.38. So state law is one possibility; "legitimate educational interest" is a remote possiblity. Massachussetts law does include governmental third party disclosures: 603 CMR 23.07(4)(c) A school may release information regarding a student upon receipt of a request from the Department of Social Services, a probation officer, a justice of any court, or the Department of Youth Services under the provisions of M.G.L. c. 119, sections 51B, 57, 69 and 69A respectively. That does not directly apply to local police, but it is possible that a police officer is operating as a probation officer or an agent of the Department of Youth Services. Under paragraph (e), A school may disclose information regarding a student to appropriate parties in connection with a health or safety emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. This includes, but is not limited to, disclosures to the local police department Mass. law allows the possibility of treating a police officer as "authorized school personnel" if they are "providing services to the student under an agreement between the school committee and a service provider, and who are working directly with the student in an administrative, teaching counseling, and/or diagnostic capacity" – which is not completely out of the question but is a bit of a stretch (especially in the context of a blanket statement "we share records", not "we may share yours, if you get special counseling"). Tne law also says "Any such personnel who are not employed directly by the school committee shall have access only to the student record information that is required for them to perform their duties", so sharing of all records would not be allowed.
There is no requirement to name the parties to a contract I just bought a cup of coffee. I did not give my name to the other party to that contract and while I know the name of the shop, I do not actually know the legal entity I contracted with. Nevertheless, we have a binding contract and, for example, if that coffee gave me food poisoning, I would have legal recourse under that contract. Similarly, there is no difficulty signing a contract under a pseudonym - it still creates a legally binding relationship. The practical difficulties While there is no legal problem, there is an evidentiary one - if someone enters a contract and later disclaims doing so, how do you prove that they did? Or vice-versa, if someone alleges that it was you that entered the contract, how do you prove that you didn’t. What you need is some way of definitively but anonymously tying the person to the contract. I can think of lots - a fingerprint, DNA, public key cryptography, a trusted third-party intermediary to name just a few. This is essentially a technical problem rather than a legal one.
A problem with the question is that it uses the loaded term "victim". If you change the question to "Are there actions that you can perform involving another person, which are crimes even if the other person consents to participating in the action", then there are very many. Selling alcohol to a minor; selling heroin to anyone; selling sex in most US jurisdictions; selling firearms to a convicted felon. Also, for a physician to assist a person in suicide, in most states. Formerly in the US, various forms of sexual intercourse were acts that consent did not make legal. Whether or not the person is a "victim" in these cases is open to debate. In the case of physician-assisted suicide in Washington, the doctor is allowed to prescribe (oral) drugs that the person ingests: only a doctor is permitted to do this, both under the DWD Act and as a consequence that only a doctor can prescribe the drugs. There seems to be a belief that it is a crime to assist a person in committing suicide, which is probably correct if the assistance is shooting the person in the head, or in general directly causing the death (thus, "I give you permission to shoot me in the head" doesn't cut it). But from what I can tell, it is not generally against the law in Washington to help a person who commits suicide (e.g. supplying the means of self-dispatching). In some countries, suicide and helping with suicide is illegal, e.g. in Kenya Penal Code 225 says Any person who (a) procures another to kill himself; or (b) counsels another to kill himself and thereby induces him to do so; or (c) aids another in killing himself, is guilty of a felony and is liable to imprisonment for life. No exception is created if the person consents to being aided to kill himself.
http://www.healthinfoprivacybc.ca/confidentiality/when-can-and-cant-they-tell-others is a pretty good summary. Different rules apply to private practices than public clinics and hospitals. I will assume that the clinic on campus is private. This is a summary of the summary about who your information can be shared with: Health care professionals can share information within your "circle of care". Specifically, they are allowed to assume your consent to this but you can explicitly withdraw that consent. This would include doctors within the same practice. Admin staff can access your information for administrative purposes. Anyone you have authorised them to share it with e.g. relatives, friends etc. The Medical Services Plan for billing and admin If you are unable to drive If there is suspected of child abuse If you are wounded by a gun or a knife If you are a danger to others For your specific questions: I asked about it and they said it's confidential, but confidential to the clinic. Correct, unless you explicitly revoke this. the counselling department can share information with the doctors This is tricker, these people may be either within your "circle of care" or they may be part of the same organisation. Notwithstanding, councillors are not doctors and are governed by the everyday laws related to confidentiality i.e. information given in confidence is confidential and everything else isn't. If you are told the limits of the confidentiality i.e. they tell the doctor, then those are the limits unless you renegotiate them. he would know I only have one kidney? Well you said "the counselling department can share information with the doctors" and this would require the information going the other way i.e. the doctor sharing with the councillor. Even if this type of sharing was OK in general (and I'm not sure it is, see above); the information shared should only be what is required for the councillor to do their job - the number of kidneys you have is probably irrelevant to this. What laws apply to situations like this where confidential information in one entity (medical office) decides to share it without the consent of the patients to another entity (the counselling dept.)? Well, we are not sure there are 2 entities: legally there may only be 1 - the university. Anyway, the laws are the Personal Information Protection Act and common law (Smith v. Jones, [1999] 1 SCR 455)
There is no general prohibition against taking down material, even non-infringing material, which is posted by some person, but there is a risk to the service provider. Abstracting away from the specifics of github, a Provider has some agreement with the User whereby User rightfully makes Stuff available on Provider's site. Arbitrarily removing Stuff (in violation of the usage agreement) may cause damage to User, who may sue Provider, and Provider will avoid that if possible. DMCA protects Provider from copyright infringement suits by Victim, providing the proper DMCA procedure is followed, and it allows Provider to remove Stuff without fear of getting sued by User (17 USC 512(g)). This protection is not available if the takedown notice is not proper. (As a case in point, the entire series of Harry Potter books is still out there freely on the internet, because only the rights holder can demand a takedown, and the rights holder seems to not be concerned).