Why aren&#39;t post-mortem records protected by HIPAA? Looking at the question Why are toxicology reports made public? and the answer provided, I have to wonder why aren't such records (autopsy results, toxicology reports, etc.) covered by HIPAA? Looking at HHS.Gov it reads: The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual. and yet autopsy and toxicology reports are treated as 'public record'.
HIPAA applies only to specified entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); including Health Plans, Health Care Providers, Clearinghouses, and &quot;Business Associates&quot;. Autopsy and toxicology records are the output not of a medical practice but of the coroner's office. The coroner is not* a health care professional; rather they are a law-enforcement official, and law enforcement are not constrained by HIPAA. Law enforcement records are often part of the public record, especially when they are attached to a court case. The office of a coroner is empowered and charged with recording deaths in their jurisdictions, and determining cause of death for violent or suspicious deaths. In some jurisdictions, they have the power to instigate investigations. They often do this by overseeing (or, generally, in smaller jurisdictions, acting as) medical examiners and/or forensic pathologists. *It is more proper to say that the coroner is not inherently a health care professional. Often, coroners may hold medical degrees. In some small (and often poor) counties, a/the local doctor does double duty. In others, the office of the coroner is combined into the office of the sheriff, and the positions are sometimes even merged into one person. In larger (and often wealthy) counties, the coroner may be a purely organizational and administrative position.
Caution: I am not a lawyer. It depends on who is doing the collecting and storing. If it is done "by a natural person in the course of a purely personal or household activity", then it is exempt from the GDPR, as per Art. 2. Beware, however, that "purely personal activity" means that you do not share or publish them. In this court case, having the name or phone number of someone else on your "personal" website constitutes "processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46".
Prove my work is not a trade secret violation Please don't. It's not your job to prove your innocence. The burden is on them to be specific, explain fully, and prove specific claims about your actions. In other words, don't justify, don't explain, and don't defend yourself to them. It's actually best you do not say anything to them, and just forward the letter to your legal counsel (Since you're selling software to be used in the medical field, I assume you already have some kind of legal counsel). For instance, even saying something as innocuous as "Managing patients, Exams, Bills etc are all public knowledge." could be used against you. Because it establishes the fact that you've been working on those features with them and that you've been working on those features with your new company (which doesn't necessarily follow, for all they know, you could have purchased a library module from someone else with those exact features). In other words, even if you were to reply with such an innocuous-sounding statement, you could be saving them months of cross-border discovery and litigation about some of their claims (even if you believed you were being entirely reasonable by defending yourself). But at the same time, don't take what I'm saying to mean that you should lie to them about which features you recently worked on. When I say that you shouldn't be talking to them. I mean that you should not be talking to them. You shouldn't be engaging with them and you shouldn't be giving them any shred of information whatsoever (implied or otherwise). It's not your job to make their job any easier. Do not reply to them. Don't even acknowledge the receipt of the letter (unless you already did by signing for it, which can't be helped). Use a legal intermediary. Give the letter to your own legal counsel (whether you signed for the letter, or not) and leave any reply to him or her (assuming he/she thinks this warning letter even warrants a response). And if this former employer gives you a phone call, kindly refer them to your legal counsel without saying another word.
That would require a change in the law. Names and salaries of public employees have been held to not be highly personal information exempt from the public records law. See Attorney General v. Collector of Lynn, 377 Mass. 151, Hastings &amp; Sons Publishing Co. v. City Treasurer of Lynn, 374 Mass. 812. This is part of the "diminished expectation of privacy in matters relating to their public employment" attaching to public employment.
Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization. If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR. This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics. Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request? No. But as the controller, you need to make sure that is is anonymized.
Does GDPR prohibit reading unsolicited emails from people who have not explicitly opted in to a mailing list? tl;dr: No. I have never heard of this, and I don't see how this could follow from the GDPR. You should follow up with the Secretary to find out how she came to her conclusion. Detailed reasoning: The GDPR restricts the processing of personal data, so it does in principle cover reading email, since reading counts as "processing", and an email may contain personal data. However, Article 2 (emphasis mine) says that: This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. I would read this to mean that a human reading emails is only covered by GDPR if the emails are part of a "filing system" or intended to be. So reading the emails is ok, it's only problematic if you intend to systematically store them. Even filing them, while covered by GDPR, would presumably be allowed, because to actually act on the email, you would have to keep it, and Article 6 allows processing of personal data to "take steps at the request of the data subject prior to entering into a contract" and when "processing is necessary for the purposes of the legitimate interests pursued by the controller". One caveat: If the email contains data that falls under special categories of personal data (Article 9) you may need explicit consent for storage. That covers things like racial or ethnic origin, political opinions, religious beliefs and health information. So if someone discloses a health problem or their religious belief in their mail, you may need to ask them for permission to keep it. In summary: At most, GDPR would require you to promptly delete the email once you no longer need it (which could be immediately if the email is irrelevant to you). If the email contains data you legitimately need (e.g. a complaint you need to follow up on), you are allowed to keep it as required (based on Article 6 (f)). Note that in both cases no explicit consent is required from the email sender, unless the email contains particularly sensitive data, such as political/religious beliefs or health data.
Publication after the author's death is still publication. As you can see in this excellent chart this work is copyrighted for 95 years after the publication date under US law. If it had never been published, it would be protected by copyright for 70 years after the death of Lovecraft, the author (a term which has now expired). However, statements of genealogy would be facts, and as such are not protected by copyright. limited quotes to support those facts would be appropriate in a work of non-fiction, and would normally be permitted as fair use under US law. Such quotes would probably not be appropriate in fiction in any case. The exact wording of the genealogy would probably be protected, but not the relationships (who is the parent of whom, etc).
Federal and state laws do protect a variety of different types of personal information in particular contexts, but there isn't really any information that is necessarily personal and protected from disclosure in all contexts. For instance, the Health Insurance Portability and Accountability Act generally protects a person's health records from unnecessary disclosure, and the Federal Education Rights and Privacy Act generally protects a student's educational records from unneccessary disclosure. But that doesn't mean that all of an American's health information is protected, or that all of the information that a hospital holds about an American is protected. The hospital can typically disclose the fact that it is treating a specific person, and if that person provides his health records to a government employer, that employer may be required to produce them in response to a request under the Ohio Public Records Act. But Facebook isn't a health-care provider, so it isn't required to protect medical records, and it isn't a school, so it isn't required to protect educational records. At the federal level, I don't know of any privacy laws that require it to maintain the privacy of its users' information, though it may be required to do so under state laws, or as a contractual matter because of its privacy policy. But that doesn't mean it has nothing to worry about. Like any business in the United States, it is prohibited from engaging in deceptive trade practices, so it can't make broad promises to protect users' privacy when it has no intention of honoring them. That's why it ended up paying $5 billion for privacy violations in the past and remains under court orders requiring it to better protect users' data. Further, Facebook has users all over the world, so it is required to comply with the international privacy regulations like GDPR that can be far more stringent.