Legal effect of &quot;I am a health care professional&quot; buttons on medical websites Similar to this question. Many websites containing medical information intended for medical professionals require that the user assert that he/she is one before the content can be accessed. Merck Connect is an example. Does a curious user (not employed in the medical field) clicking on the "I am a health care professional" button to access the content risk liability of any kind? In particular, do the actions of merely clicking said button (whereby said user falsely asserts he/she is a health care professional) or accessing the content behind the button (which may be restricted by law or otherwise) attract liability? What relevant legislation exists, if any, regarding access to said websites? Answers should focus on the United States, but answers involving other countries will be accepted as well. Under French law, the following requirement exists, based on a December 2011 law on food safety effective May 2012 (see http://www.itena-clinical.com/en/): les sections des sites internet réservées aux seuls professionnels de santé doivent être, a minima, accessibles après une page d'engagement de l'internaute, certifiant qu’il est un professionnel de santé. Rough translation based on Google Translate output: sections of websites reserved solely for healthcare professionals shall only be accessible after at least an agreement page certifying that the user is a healthcare professional. Does a similar requirement exist under United States federal law?
The purpose of the button is not to put liability on you, but to shield the website from liability. The website does not want you looking up information about drugs, deciding that a particular drug is right for you, causing yourself harm and then blaming the website. You may have acted unlawfully but you would have no liability because no injury (financial or otherwise) has been caused to the website. Clicking the button is an assertion that one is a medical professional. This is a false statement, so the website could sue you for the tort of deceit, but there is no injury, which is one of the elements of deceit. The website would not even get nominal damages. The button may also constitute a contract. In exchange for access to a website, you warrant that you are a medical professional. You are not, which is a breach of the contract. However, the damages are nil. Conceivably, if you passed the information on to someone else who misused it, there may be some injury to the website, and then you would have to compensate the website for that injury under one or both of the heads of liability described above. In terms of criminal liability, it is rarely an offence to make a false statement to a private body without some other aggravating element. For example, in Australia, it is an offence to make a false statement for financial gain, or to make a false statement to a government official (regardless of whether there is financial gain etc). But simply making a false statement is not by itself a crime. You may breach a computer law. The United States Computer Fraud and Abuse Act is pretty broad. Obtaining information from a computer without authority is an offence: 18 USC s 1030(a)(2)(C). The only exception is if the web server is in the same state as you and somehow nobody from outside the state can access it: see definition of 'protected computer' in 18 USC s 1030(e)(2).
Not on its own, no Overview A ToS can be of some value, but will not fully protect the site operator (host). For one thing, a ToS is probably not binding on the user based on a contract of adhesion such as &quot;by using this site you agree to...&quot;. A specific act, such as clicking a checkbox that defaults to clicked or activating an &quot;I accept the terms&quot; button is probably required to make a ToS binding on the user. But a host must do more that obtain an agreement to its ToS. Once it has actual knowledge of illegal content, a host must take action to remove or disable it, or else it may be liable as if it had posted the content itself. It also depends what kind of &quot;something illegal&quot; is involved. The most common form is perhaps content that allegedly infringes copyright. Safe Harbor In the EU Article 14 of the EU Directive on electronic commerce (Directive 2000/31/EC) will apply (note that being a directive, rather than a regulation, 2000/31/EC) depends on implementation in national law, which may vary from one country to another. Article 14 reads: Hosting Where an information society service is provided that consists of the storage of information provided by a recipient of the service, Member States shall ensure that the service provider is not liable for the information stored at the request of a recipient of the service, on condition that: (a) the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or (b) the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information. Paragraph 1 shall not apply when the recipient of the service is acting under the authority or the control of the provider. This Article shall not affect the possibility for a court or administrative authority, in accordance with Member States' legal systems, of requiring the service provider to terminate or prevent an infringement, nor does it affect the possibility for Member States of establishing procedures governing the removal or disabling of access to information. Article 14 means that when a host obtains actual knowledge of infringing or otherwise illegal content, the host must promptly delete that content or disable access to it. Such knowledge could come via a takedown notice. According to the page &quot;Copyright infringement and remedies in Germany&quot;: One of the main situations refers to platform operators. Once they have been informed about a specific infringement on their platform, they are required to remove the specific infringing content and to implement measures in order to prevent future violations. See also the Wikipedia article &quot;Notice and Take down&quot; which discusses Article 14, and points out that it does not define a specific notice and take down procedure, unlike the US provisions of 17 USC 512 (which includes the DMCA notice and take down procedure, and the related Safe Harbor provisions). Since Article 14 clearly envisages some sort of notice procedure, but not specific procedure has been defined in the laws of most EU member states, including Germany, some people use the US DMCA notice format, as describesd in this article. Such a notice may serve to give a German host &quot;actual knowledge&quot; and impose liability if the host fails to respond promptly. There have been recent legal cases which affect the procedures in such cases, as reported in &quot;Copyright 'safe harbours' for service providers need to be consistent&quot; from Pinsent Masons and &quot;Germany: Time To Hit Pause: Copyright Infringement On User Generated Platforms – When Is The Platform Provider Liable For Damages?&quot; from Morrison &amp; Foerster LLP. The Morrison &amp; Foerster article reads: Previous rulings by the CJEU have addressed both the application of the safe harbor principle set out in the EU E-Commerce Directive1 that shields hosting providers from liability for hosted unlawful third-party content of which they have no actual knowledge and, separately, the extent of infringement of copyright by hosting of, or linking to, copyright infringing third-party content under the EU Copyright Directive. But it is still unclear under which conditions the providers of the various online platforms that store and make available user-generated content, can rely on the safe harbor privilege applying to hosting providers to avoid liability, or whether they must not only take down the infringing content when they obtain knowledge of such content but also compensate the rightsholders of such content for damages for copyright infringement. The Pinsent Masons article reads: [A] ruling last year by a German court has highlighted an anomaly in the way 'safe harbour' protections ISPs enjoy under EU law apply in the case of copyright enforcement. It has confirmed that applications for blocking orders and injunctive relief are treated differently, despite the economic effect of those measures being the same. The safe harbour protections stem from the EU's E-Commerce Directive. That legislation prohibits service providers from being put under any general obligation to monitor for illegal activity by users of their service. In addition, where the service providers are mere conduits to infringing activity by others, they cannot be held liable for that activity unless and until they obtain 'actual knowledge' of the activity. At that stage, a service provider must act expeditiously to remove or to disable access to the information if they are not to be held liable themselves for infringement. However, EU copyright law cuts into these 'safe harbour' protections. It makes clear that rights holders can apply for an injunction against intermediaries whose services are used by a third party to infringe copyright. In Germany, however, changes made to the Telemedia Act in October 2017 have spurred debate over the admissibility and the requirements of blocking injunctions. Other unlawful content Other sorts of illegal content are possible, such as neo-Nazi propaganda and Child Pornography, which are criminal under German law. In theory Article 14 applies to such content as well as to alleged copyright infringements. But since these are serious crimes, the degree of promptness expected from a host will probably be greater. Conclusion A hosting provider will need, at the least, to respond to notices alleging copyright infringement or other illegal content, and provide an address to which such notices can be sent. A host might do well to implement the full DMCA takedown procedure. ToS provisions will not provide a shield against liability after a notice is sent to the host. A host may be required to block future access by those whose previous uploads have been found to be unlawful. This may require soem sort of log-in procedure. Thus a simple ToS provision, as described in the question, particularly in the absence of any log-in mechanism, and of any enforcement of the ToS provisions, will not be enough to shield the host from liability for unlawful content posted by users.
Yes. There is both a duty to disclose and permit inspection of certain records (e.g. those that adversely affect either party's case or support another party's case) and a right for the court to demand access to other specific records. In england-and-wales the applicable rules are found in Part 31 of the Civil Procedure Rules. For example: Standard disclosure 31.6 Standard disclosure requires a party to disclose only– (a) the documents on which he relies; and (b) the documents which – (i) adversely affect his own case; (ii) adversely affect another party’s case; or (iii) support another party’s case; and (c) the documents which he is required to disclose by a relevant practice direction. Specific disclosure (1) The court may make an order for specific disclosure or specific inspection. (2) An order for specific disclosure is an order that a party must do one or more of the following things – (a) disclose documents or classes of documents specified in the order; (b) carry out a search to the extent stated in the order; (c) disclose any documents located as a result of that search. Party's control 31.8 (1) A party’s duty to disclose documents is limited to documents which are or have been in his control. (2) For this purpose a party has or has had a document in his control if – (a) it is or was in his physical possession; (b) he has or has had a right to possession of it; or (c) he has or has had a right to inspect or take copies of it. Right of inspection 31.3 (1) A party to whom a document has been disclosed has a right to inspect that document except where – (a) the document is no longer in the control of the party who disclosed it; (b) the party disclosing the document has a right or a duty to withhold inspection of it, or (c) paragraph (2) applies. (2) Where a party considers that it would be disproportionate to the issues in the case to permit inspection of documents within a category or class of document disclosed under rule 31.6(b) – (a) he is not required to permit inspection of documents within that category or class; but (b) he must state in his disclosure statement that inspection of those documents will not be permitted on the grounds that to do so would be disproportionate. Inspection and copying 31.15 Where a party has a right to inspect a document– (a) that party must give the party who disclosed the document written notice of his wish to inspect it; (b) the party who disclosed the document must permit inspection not more than 7 days after the date on which he received the notice; and (c) that party may request a copy of the document and, if he also undertakes to pay reasonable copying costs, the party who disclosed the document must supply him with a copy not more than 7 days after the date on which he received the request. And, in case there's any doubt that this applies to electronic records: Meaning of document 31.4 In this Part – ‘document’ means anything in which information of any description is recorded;
The vaccine card doesn't have a specific legal status under US law. There are federal laws against fraud which would encompass vaccine card fraud, but tidying up disparate notices into a single notice is not fraudulent (there is no attempt to deceive), as long as you don't falsify signatures, seals, or specific information. From a practical perspective, though, the official vaccination record from your state is a better and more official way to have a single proof of vaccination. There is probably no practical way to transport vaccinations from a foreign country into the US system, but that is a question best asked on Travel, since it's not about the law, it's about quasi-legal mandates authorized under broad laws that say &quot;in an emergency, the government can stipulate necessary rules&quot;.
If the requirement is imposed by an employer, then the basis for an exemption, if any, would be whatever the employer choose to allow, unless some applicable law required some particular exemption. Such mandates are not common. Indeed I do not recall hearing of any such absolute mandates. But an employer could choose to impose one, and I have heard (and read) discussions of hospitals, for example, requiring COVID-19 vaccinations to be taken by employees when available. If an employer mandates a vaccination, it is up to the employer to decide when, and if, an exemption is warranted. It is up to the employee to decide whether to comply by accepting the vaccination or refuse at the risk of being fired. I do not know of any law which would specifically require an employer to grant exemptions in particular circumstances. A law might exist, or be passed, requiring such exemptions. If the employee had a particular medical condition which makes a vaccination si9gnificantly more risky for that employee than for an average person, and if that condition was considered to be a disability (not all or even most medical conditions are so considered) then the Americans with Disabilities Act (ADA) would require the employer to offer a &quot;reasonable accommodation&quot; to the employee, if one is available. Exactly what accommodation is &quot;reasonable&quot; is a fact-based determination, and would depend on the reason for the mandate, the cost and burden of the accommodation on the employer, and the degree if risk to the employee with and without the accommodation. In some cases no accommodation is found to be &quot;reasonable&quot;, and in such cases the ADA does not mandate any accommodation at all. The ADA generally specifies whet must be done when an employee has \ a disability, but dopes not specify exactly how a disability must be proved. A medical certificate is common, but njot invariable, iof an employer questions the existence o a disability. The ADA would not require an exemption for a &quot;Religious/Philosophical&quot; objection. Soem state laws protect religious scruples in various particular employment situations. In some but not all states objections on such grounds for vaccinations otherwise required for school attendance are honored. The exact grounds accepted vary from state to state. A specific state would need to be listed for a more specific answer to be given, and I am not aware of any state that has such a requirement for exemption from a private employer's vaccine mandate. Addition: It seems from comments that some employers, such as hospitals and the military, already require vaccinations for some diseases. This seems reasonable to me, and does not change my answer otehrwise.
The Right to Access is pretty absolute. However, there are some limitations: Is the service even the Data Controller for the data in question? Here, you're talking about notes of one user about another. Is the platform the controller for the notes, or would the note-taker be the controller? Or both, jointly? If the platform weren't a controller but merely a data processor for these notes, it would be illegal for them to disclose the information. Trish also correctly points out that the GDPR does not apply to processing for purely personal or household purposes, e.g. personal social media use. So GDPR would not provide a basis to compel a user to disclose their notes to the data subject, assuming that the note-taker is covered by this exception. Of course, this exception wouldn't apply if the notes are taken for other purposes, e.g. professional networking. Also, this exception doesn't affect the platform. There is an explicit limitation to the right of access in Art 15(4): The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. Disclosing user A's notes about user B to user B would likely violate the privacy rights of A. The notes are both A's and B's personal data. However, the correct balance depends on context. E.g. an employer probably can't refuse to provide access to a performance assessment merely because it was written by an identifiable manager. The UK ICO has provided detailed guidance on this aspect to the right of access. They propose a three-step test: Step one – Does the request require disclosing information that identifies another individual? For example, it might be possible to redact other people's information (but not in your Mastodon notes example). Step two – Has the other individual provided consent? Step three – Is it reasonable to disclose without consent? What is reasonable is highly context-dependent, but UK data protection law gives some concrete criteria to consider. The EU EDPB has draft guidance on the Right to Access. They note that the Art 15(4) can cover a wide range of rights, not just other people's privacy rights. But as in all things, the data controller is required to strike an appropriate balance between user A and B's conflicting rights. In the Mastodon user notes scenario, I think that the note author's rights to privacy should be considered more important than the data subject's right to access those notes, thus making it possible to reject that part of a DSAR under Art 15(4) GDPR. If we assume that the note-taker A is a (joint) controller for these notes, then it would also be necessary to consult them before making a decision about the access request.
Federal and state laws do protect a variety of different types of personal information in particular contexts, but there isn't really any information that is necessarily personal and protected from disclosure in all contexts. For instance, the Health Insurance Portability and Accountability Act generally protects a person's health records from unnecessary disclosure, and the Federal Education Rights and Privacy Act generally protects a student's educational records from unneccessary disclosure. But that doesn't mean that all of an American's health information is protected, or that all of the information that a hospital holds about an American is protected. The hospital can typically disclose the fact that it is treating a specific person, and if that person provides his health records to a government employer, that employer may be required to produce them in response to a request under the Ohio Public Records Act. But Facebook isn't a health-care provider, so it isn't required to protect medical records, and it isn't a school, so it isn't required to protect educational records. At the federal level, I don't know of any privacy laws that require it to maintain the privacy of its users' information, though it may be required to do so under state laws, or as a contractual matter because of its privacy policy. But that doesn't mean it has nothing to worry about. Like any business in the United States, it is prohibited from engaging in deceptive trade practices, so it can't make broad promises to protect users' privacy when it has no intention of honoring them. That's why it ended up paying $5 billion for privacy violations in the past and remains under court orders requiring it to better protect users' data. Further, Facebook has users all over the world, so it is required to comply with the international privacy regulations like GDPR that can be far more stringent.
A medical practitioner may use whatever methods s/he thinks proper and appropriate, subject to the limits of malpractice law, and to the right of the patient (or patient's parent or guardian for a child) to give informed consent to any procedure or treatment. A patient can not insist on a treatment or method that the doctor or dentist does not wish to perform, having only the right to seek another practitioner. Nor is a practitioner required to use only procedures covered by insurance, unless bound by contract to do so (as may be the case with some &quot;in-network&quot; or HMO agreements). Again, the patient is free to seek treatment elsewhere. So the parent could insist that the dentist not use &quot;conscious sedation&quot; by withholding consent, the dentist may then refuse to treat at all, unless perhaps this was an emergency situation not allowing the parent to seek another treatment venue.