Log Viewing Specific Patient PHI? Under the HIPAA and HITECH Regulations (US) is it required for a system to record an audit trail for every time a user accesses any PHI(Protected Health Information)? As I understand it, an audit trail of user logins is required, as well as any time a user adds, edits, or deletes PHI. Does simply viewing / accessing PHI need to be logged as well?
Simply viewing must be logged. 45 CFR 170.210(b) Record actions related to electronic health information. The date, time, patient identification, and user identification must be recorded when electronic health information is created, modified, accessed, or deleted; and an indication of which action(s) occurred and by whom must also be recorded.
The "Privacy Rule" (45 CFR Part 160 and Part 164, Subparts A, E) don't forbid this. Sect. 164.502 states the general rule: (a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. "Health information" is defnes in part 160 as any information, including genetic information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. Your picture would not constitute health information (and anyhow, they are allowed to gather health information, just not freely disseminate it – the pictures on the wall were presumably with permission). There is no general law (which would be state law) against taking a person's picture (though commercially exploiting someone's picture would require permission, via the concept of personality rights), and it is directly required in a number of instances (for identification purposes – school ID, driver's license, passport, voting in some states). It is an unusual requirement and since they scanned your driver's license it is especially inexplicable. Assuming that this is just a story they tell all patients because they want before and after pictures (which you would have to consent to, if you didn't already in one of those "sign here" flurries), saying that this is for "security purposes" would be untrue, but I don't think it's actually illegal. Taking but not using a photo would not cause you harm, so if you had let them take the picture, there would not be a basis for suing. If they use it for advertising without permission, that would be a problem.
There are circumstances in which medical ethics historically authorized treating physicians to defer sharing information with patients or even to mislead them in their best interests medically, although the scope of what is considered ethical in that regard is narrowing. But in the fact pattern described in the quoted material there is no plausible way that this withholding of information could be justified. If it was intentional (or for that matter, even if it was negligent) there could be grounds for tort liability for harm caused as a result (although causation and damages are hard to prove). On the other hand, just because it could give rise to tort liability, doesn't imply that the action is necessarily a crime, at least without some kind of motive other than random spite to intentionally provide a false result. However, it is quite difficult to come up with a believable reason that this would happen to someone at random. If the person taking the test bribed someone to provide a false result, which is plausible, that is one thing, but just doing it randomly really doesn't make any sense. The fact pattern provided sounds like it doesn't include the &quot;full story.&quot; Why keep records of the actual test results (or for that matter why do the actual tests at all) if you are merely going to intentionally provide a false negative?
No, nor can I request a copy of your tax return. See 5 USC 552a. Record maintained on an individual are not subject to disclosure.
California Penal Code 647f states that being intoxicated in public is prohibited. When the police arrived, they were confronted with probable cause for an arrest. They (presumably) became aware of the matter because the doctor called the police, since she believe that you would drive drunk. (We can inquire into whether that was a reasonable belief, but it doesn't matter, what matters is that she had the belief and acted on it). Now the question is whether the doctor acting on the belief (making the call) was legal. A negative answer does not affect the legality of the arrest. There is also a law imposing on medical professionals a duty to report, which is fairly wordy, but does not seem to directly require reporting the fact that a person is publicly intoxicated. However, attending circumstances could have suggested one of the triggering causes for mandatory reporting (wounds, for example). Again, it does not matter (to a point) if, in the light of close scrutiny, the doctor's conclusions were mistaken. When doctors are required to report facts to the police, reasonable over-reporting is not penalized. There is also no law against calling 911 to report a potential DUI (the usual public-campaign focus is on those actually driving). So calling the police under the circumstances falls between "allowed" and "required". The HIPAA privacy rule could be relevant because that theoretically could block the doctor from making the call. (Note that the doctor, and not the patient, is bound by the confidentiality requirements). §160.203 allows exceptions to the confidentiality requirement if "necessary... For purposes of serving a compelling need related to public health, safety, or welfare", so an exception may have been granted. If this was done within the scope of a mandatory reporting law, it is legal to disclose PHI; under §164.512 it is allowed, "to prevent or lessen a serious and imminent threat to the health or safety of a person or the public". A confidentiality agreement would not increase your chances of being arrested. If the doctor's confidentiality statement were less restrictive than HIPAA, HIPAA prevails (the law trumps contract terms). If it is the same as HIPAA, it has no effect (and simply states what HIPAA says – the normal case). If the agreement were more restrictive, it is possible that the doctor calling the police would be a breach of contract, unless the call was required by law. You would have to see what in the agreement would have prohibited calling the police. But that would not affect the validity of the arrest. To re-phrase the matter: the arrest was because you were found to be intoxicated in public. The police were there and could judge your state (probable cause). They were there by permission of the property owner, so the arrest was not unlawful for lack of a warrant. That is as far as one can go in searching for an illegality to the arrest itself. One might go further and ask whether the doctor has committed an actionable wrong by calling the police with her suspicions. This could go either way: it really depends on the full set of details, regarding your condition. If the doctor suspected that your actions fell under one of the mandatory reporting categories, she had to report, and otherwise it is not prohibited under HIPAA. If a person is intoxicated and answers the question "Would you normally proceed to drive home in this state?" in the affirmative, then it is a reasonable inference that the person will do so. An answer "No, absolutely not", on the other hand would work against the "public danger" inference: that has no effect on the arrest, but could have an effect in a suit against the doctor (violation of the privacy rule). In such a suit, the doctor's defense would presumably be that despite the answer, she still had a reasonable belief that you were a public danger. Then the matter would reduce to what other facts she knew of that would support a public danger conclusion.
Term 1 isn't going to hold up, but that is not a GDPR matter. It's just a matter of basic consumer protection law in the EU. You can't offload responsibility for your mistakes. Looking at 2, Dale M. already pointer out that it's now how the GDPR works. You are the Data Controller. X,Y and Z are Data Processors. Article 28(1) of the GDPR is in direct conflict with your disclaimer. You accept zero responsibility, the GDPR says you are fully responsible. That's the exact opposite.
This article basically says &quot;it depends&quot;: If it is genuinely used to improve tenant safety then that is OK, but if it is used to track your private life then that is not acceptable. Cameras that cover communal areas used by several properties are generally acceptable, but cameras covering individual properties are much less so. It sounds like this falls into the latter category. Assuming you haven't got the camera yet, I suggest you write to the Landlord asking for a written justification of the cameras, and a policy for the use of the camera. E.g. it will only be viewed if an incident is reported. Once you have the justification you can then look for inconsistencies (e.g. if they aren't planning to snoop at random times, how are they going to notice someone up to no good? And how would they tell?) You could also just say &quot;no&quot;. The installation of this camera probably counts as a material variation of the rental agreement. You could also propose a compromise: you will install the camera, but only provide footage as you see fit rather than allowing your landlord to view the camera at any time. CCTV installations are covered by the GDPR, so you should ask your landlord for the associated paperwork. Amongst other things they will need to state how long they want to keep the footage and provide a justification for that. &quot;We might want to re-run it&quot; is not a justification. Having all this stuff written down will help if you ever suspect he is abusing the footage. Edit Another thought: does the landlord own other properties? Are they having cameras installed too? If not, why not? They should have a policy about this.
Health care providers in the US may send protected patient records to other health care providers for the purposes of treatment, either of the patient whose information it was or of a different patient (for instance, a doctor could send a chart of a different patient with a similar issue). This can be done without patient authorization, except for two cases: if the patient has requested more restrictions on use of their information and the provider agreed to those restrictions, and with psychotherapy notes. Source: HHS. WhatsApp specifically does not appear to be compliant with HIPAA, which is the US medical privacy law. However, there are many similar systems that are compliant. The body of your question asks about taking a smartphone screenshot; with many secure messaging systems, this is perfectly acceptable, and the principle of a doctor consulting with another doctor about a patient is actually encouraged. HIPAA violations do not by themselves result in any action against a medical license, nor can anyone besides the US government file suit based on a violation (everyone else is limited to complaining to the US government). Private lawsuits and (especially) license consequences are determined by state law, and are state- and situation-dependent. A doctor who calls a press conference to announce that this patient of his has HIV is more likely to face sanctions than a doctor whose violation was just not using a secure enough messaging client. HIPAA violations like this are not that uncommon, and generally result in at most a fine against the practice.