Is an official patient/physician relationship required for HIPAA to apply? Inspired by a tweet I saw a moment ago: https://twitter.com/shanselman/status/1511783399580581888 She's a nurse and not only do I know that her sister in law N**** is coming in from out of town, she had a BBL and is worried about leakage while on the plane. I think this is a Hipaa violation? Names censored. In this case, does the profession of the lady talking about her sister in law, medical nurse, automatically mean that HIPAA applies and she is illegally sharing private medical data without patient consent? Or does HIPAA only apply to medical professionals when the data concerns that of one of their official patients?
The rule applies to &quot;A covered entity or business associate&quot;, who may not &quot;use or disclose protected health information&quot; except as permitted. The set of covered entities and business associates is pretty large, and certainly covers nurses, also secretaries working for the hospital or insurance company. It is not restricted to the doctor-patient relationship. However, the restriction is not absolute: a patient can consent to the disclosure of such information: but, the consent must be written. This raises an interpretive challenge, in case patient A reveals a medical fact to a friend B who happens to be a medical professional. Person B probably is a &quot;covered entity&quot;, since they are undoubtedly A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. The information also is &quot;protected&quot;: Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. Para 5 on prohibited uses and disclosures explicitly lists the prohibited disclosures (genetic information for insurance underwriting, sale of PHI), so idle gossip is not explicitly prohibited. It is also not explicitly allowed. But again, the regulation says: may not use or disclose protected health information, except as permitted or required by this subpart Nothing in the rules limits the obligation of a &quot;covered entity&quot;, in terms of how they came to be in possession of PHI. Given the definition of &quot;covered entity&quot;, the fact of being a covered entity is a property does not depend on obtaining information electronically. So without written consent, B who is a covered entity cannot gossip about A's medical status.
You premise is correct. The processor is someone that processes data on your behalf, and since the GDPR definition of processing is extremely broad, that is about every third party subcontractor that you use for data processing, including various cloud providers. I'm afraid it will soon become a huge mess with a gazillion contracts to sign. I disagree. Yes, the GDPR says that a contract between the controller and processor must exist, but Article 28 of the GDPR does not say anything about how the controller shall document these instructions. Basically, in cases like the one you describe where John Doe relies on a web agency for having a contact form on the web, there will be a standardized (by the web agency) service agreement between the John Doe (controller) and the web agency (processor). There is nothing stopping the parties from agreeing that this service agreement that John Doe accepted as part of the onboarding procedure is also the DPA as required by the GDPR. Putting something like the following in the service agreement would do it: The parties agree that this Service Agreement between You (controller) and Us (processor) set out Your complete and final instructions to Us in relation to the processing of Personal Data and that processing outside the scope of these instructions (if any) shall require prior written agreement between You and Us. You also agree that We may engage Sub-processors to process Personal Data on Your behalf. The Sub-processors currently engaged by Us and authorized by You are listed in Annex A. I think we will se a lot of amendments in service contracts as the GDPR gets better understood, but I don't really see a flood of DPAs in addition to these amended service contracts.
Merely encouraging people not to vaccinate via educational and political communication without purporting to provide individualized medical advice is probably not the practice of medicine and protected by the First Amendment's protections for freedom of speech, rather than constituting medical malpractice. Also, many anti-vax individuals (I couldn't quote a percentage) do so out of religious conviction and are protected not just by the freedom of speech in the First Amendment, but also by the free exercise component of the freedom of religion under the First Amendment. Generally speaking, it is harder to find a legal grounds for disregarding the free exercise of religion than it is to find a legal basis to regulate otherwise free speech. For example, commercial speech is subject to more rigorous regulation than private political and educational speech, which is why there are no private businesses taking anti-vax positions in their advertising. The theory is that courts are not in a good position to make general determinations of the truth of policy positions or statements about general truths as opposed to what happened in a particular transaction or occurrence. This is in part because a ruling by the right court at the right time can preclude the correctness of its determination from being revisited indefinitely and from time to time, accepted conventional wisdom and scientific consensus at one time are revealed later on to have been wrong with more discussion and investigation. I think that this is unlikely to be the case in the vaccination area, but the whole point of the First Amendment's protection of these kinds of issues is that we can't know in advance what will continue to be widely accepted and what will turn out to be mistaken. But, if someone in a medical diagnosis and treatment profession (e.g. M.D., D.O., physician's assistant, or nurse), were to advise a patient in a capacity as a medical care provider not to vaccinate, and as a result that person's child got sick from a disease that vaccination could have prevented, there probably would be medical malpractice liability. A somewhat similar issue arises when health insurance companies or government agencies set rules on providing care. In those cases, it isn't uncommon to have a physician or other medical professional placed on a committee or in an office such as medical director, with that person making the call and exposed to liability although not in the same way as a treating medical professional. A case about a month ago found malpractice by an insurance company's medical director (the company was United Health) to be a huge liability for both the medical director and the insurance company.
The GDPR has an exemption for purely personal or household activity. Creating a family tree seems purely personal as long as you don't publish it. You're also allowed to freely share the tree as long as it stays within that purely personal scope. Your proposed restriction of only showing data of blood relatives seems excessively strict. But assuming that this exemption wouldn't apply, there'd probably still be no problem. The GDPR does not require you to always obtain consent. It requires that the purposes for which you process personal data are covered by some legal basis. Consent is one such legal basis, but legitimate interest is another. You can likely argue that you have a legitimate interest to create a tree of your (extended) family. The legitimate interest must be weighed against the rights and freedoms of the affected persons. For example, contact information could be used for stalking. The balance of the legitimate interest check can be changed if you adopt suitable safeguards. Your idea of only sharing data with close relatives would be such a safeguard, but it might not be necessary. When you rely on legitimate interest, the affected person can object to further processing, furthermore they can request to be erased from your records. A request for erasure can be denied if there are overriding grounds to keep the data. E.g maybe only contact information has to be deleted but names, dates, and relations might be kept. You should notify persons when they are included into your records. It is your obligation as the data controller to make these decisions. If someone disagrees they can sue you or lodge a complaint with a supervision authority. Note that dead persons are not natural persons in the sense of the GDPR, and have no privacy. However, national laws may provide such protections.
If you are worried that some secret will become public, you should find and meet with an attorney, not a financial adviser or other nonlawyer. Your attorney is able to shield your secret information from disclosure in ways other professionals cannot. Raise any credit score issues you're concerned about. In general, the public has a right to access judicial records. See Nixon v. Warner Communications, Inc., 435 US 589, 597 (1978) (noting that the right is rarely litigated and not clearly defined). That right is not absolute; some records can be sealed, which means that the public can't read them. Local rules govern when that happens. I don't think the existence of a civil lawsuit could be made secretly except in special circumstances. Likewise, the plaintiff usually must identify herself, except in special circumstances. A plaintiff should assume that everything about the lawsuit--who filed it, against whom, what evidence arises, the trial, and who wins and loses--will be public.
The health insurance contract should set forth what is and is not covered in detail (in addition, there would be a short summary version). They probably don't have to provide procedure codes that are covered or not covered because no such one to one correspondence exists because the language of the insurance contract is controlling and does not exactly correspond to procedure codes. For example, one of the basic eligibility questions is whether a procedure is medically necessary. A procedure may be medically necessary for one person, but not for another, and usually a denial based upon medical necessity is subject to appeal to other medical professionals engaged by the insurance company. Unless the insurance contract provides that an EOB must contain procedure codes, it probably doesn't have an affirmative obligation to do so, because there is no general principle of law that would require them to disclose their internal classification of services provided outside of a litigation context. And, in a litigation context, you probably could obtain procedure codes in discovery from the insurance company, as the code assigned to a procedure on an EOB would almost surely not be privileged or a legally protected secret. It may very well be that the company has an in house set of procedures for certain common diagnosis codes that are routinely allowed or are flagged for review by an insurance company bureaucrat. But, that would ordinarily be considered something of a trade secret of the company and is not a statement of what is or is not allowed under the actual health insurance contract. However, the privilege against disclosing the information in that context would flow from trade secret law and not from the fact that they are PHI. I don't agree that PHI is the correct reason for failing to disclose that information (unless some case law of which I am not aware has interpreted it differently). The federal law definition of PHI is at 45 CFR 160.103: Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information: (i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In employment records held by a covered entity in its role as employer; and (iv) Regarding a person who has been deceased for more than 50 years. The cross reference to 20 U.S.c. 1232g(a)(4)(B)(iv) reads as follows: (iv) records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. In short, it is B.S. that you are being given an illegitimate reason for not complying with your request, but it is probably still within the company's rights for other legitimate reasons to deny your request.
Assuming that the documents were either true, or Manning reasonably believed that they were true, there would be no cause of action for defamation. Many of the documents disclosed would have been confidential in some sense, but usually a violation of a confidentiality statute has a criminal sanction associated with it, but does not carry with it a private cause of action &ndash; in part, because conceptually, the party actually harmed is considered to be the government and not the person about whom information is revealed. It is also possible that Manning could utilize the state secrets privilege as a defense and have such a suit dismissed on the grounds that a full and adequate defense of the claims would require the disclosure of official state secrets. For example, if a covert agent were murdered due to a wrongful disclosure of information, usually official disclosure of the fact of being a covert agent would be required to prove the case, and that evidence would be barred by the state secrets privilege, effectively barring the lawsuit entirely. Constitutional claims of privacy violations under the 4th Amendment generally relate to the wrongful acquisition of information and not its wrongful disclosure. The constitution bars unreasonable search and seizure, not unreasonable disclosure of information. The only privacy tort that might be applicable is "Public disclosure of embarrassing private facts." (A sister privacy tort, Intrusion upon seclusion or solitude, or into privacy affairs, is directed at the collection of data phase and not the dissemination phase). See Restatement of the Law (Second) of Torts, §§ 652B and 652D. But, this tort raises serious First Amendment concerns and has not been widely adopted. Realistically, this tort is unconstitutional in the absence of an affirmative contractual or quasi-contractual duty not to reveal facts that runs to the person making the disclosure, and in general, Manning would not have that kind of relationship. The classic public disclosure of embarrassing private facts case would involve a lawyer's or psychotherapist's revelations about a client. Also, in the case of the public disclosure tort the basis for damages is largely personal emotional distress and violation of trust, as opposed to damage to reputation, per se. The requirement is that the disclosure be embarrassing or breach of contract, not that it harm someone's reputation since you have no legal right to a reputation that differs from the truth.
I did not write "confidential" on my letter, but I assumed a business proposal is automatically considered as a confidential material. An incorrect assumption unfortunately. Unless you have a confidentiality agreement (NDA) with the first company, they and their agents are not under any legal obligation to keep information you share with them confidential. How is the legal situation here? There is none on your side. You lied about a direct question asked and were caught in the lie. Company A had no obligation to keep what you sent confidential. Even if they did, that may not (depending on how the confidentiality agreement is worded) keep the employee of company A stating that they had received the same proposal. Chalk this one up to a lesson on confidentiality and honesty in business. There are no reasonable assumptions of confidentiality in business unless you specifically state that they are confidential or are provided as part of a confidentiality agreement.