Allergies, Sudafed, HIPAA, a prescription, and the logbook/databse A few years ago I learned about the Sudafed logbook-that-is-implemented-as-a-database. I had to do my own research about it because the person at the Walmart pharmacy didn't know anything and stammered out a few things, most of which made no sense. While doing research, I discovered several believable stories of people buying sudafed for allergies, yet were harassed and/or arrested by their local authorities. One particular example: http s://www.alternet.org/woman-allergies-arrested-and-imprisoned-buying-sudafed Putting your name in a controlled item database increases your risk to get arrested for possessing the controlled item. Fundamentally and unarguably. I'm not interested in getting arrested, nor trying to fight a legal battle if I do. Also, I'm not interested in doing anything illegal. I had thought that getting a prescription for Sudafed would solve my problem, since HIPAA should come into play. As far as I am aware of, it should, and it did (years ago I managed to get a Doctor to prescribe me some Sudafed). I stopped going to that doctor, and I think he died (old age), so I didn't get any more Sudafed, nor could I go back. Recently, I talked to a nurse and a pharmacy tech involved in my treatment and they said that HIPAA would not apply and that I'd still be logged in the database. Complaining about being in a database sounds kind of kooky, and people make out to be moreso than it is. However, knowing a couple things about how forensics, analytics, and the legal ramifications of how computing systems work, if you leak any information anywhere at any time, it can and will be used against you. I had heard that Sudafed's replacement is not effective, so I haven't tried it yet. Due to these hurdles, I'm thinking of giving it a try to see if it works for me. I use Claritan and Flonase as well, but it seems that I have different symptoms based on different allergens, so depending on the problem I use one or all of the three. Does buying OTC Sudafed enable the protections of HIPAA? Or do you and/or the pharmacy still have to record your details into the logbook/database?
The "logbook" is required by federal law, part of the Combat Methamphetamine Epidemic Act of 2005. See 21 USC 830 (e) (1) (A): Each regulated seller shall ensure that, subject to subparagraph (F), sales by such seller of a scheduled listed chemical product at retail are made in accordance with the following [...] (ii) The seller maintains, in accordance with criteria issued by the Attorney General, a written or electronic list of such sales that identifies the products by name, the quantity sold, the names and addresses of purchasers, and the dates and times of the sales (which list is referred to in this subsection as the “logbook”), except that such requirement does not apply to any purchase by an individual of a single sales package if that package contains not more than 60 milligrams of pseudoephedrine. "Scheduled listed chemical" is defined in 21 USC 802 (45) and includes pseudoephedrine (the active ingredient of Sudafed). As you can see, no distinction is drawn between prescription and OTC purchases. HIPAA became law in 1996. I'm not sure whether HIPAA would normally forbid the keeping of such a logbook (it mostly restricts how a provider can disclose information, not so much how it can store information), but even if it did, CMEA was passed later, so it would take precedence. Thus there is no way to "enable HIPAA" to avoid CMEA's requirements. (The passage quoted above does indicate a possible way to avoid the logbook: buy less than 60 mg at a time. That seems to correspond to two standard tablets. However, it's conceivable that a pharmacy might decide it wants to put such purchases in its logbook anyway; it's not clear to me that HIPAA or any other law would forbid them from making that a condition of purchase.) There may also be specific laws in your state placing further restrictions on pseudoephedrine purchases.
It may be discrimination; not all discrimination is illegal. Details vary by jurisdiction, for example discrimination on the following bases is illegal in Australia: race colour sex sexual preference age physical or mental disability marital status family or carer’s responsibilities pregnancy religion political opinion national extraction social origin A medical condition like an allergy is not necessarily a physical disability. The school is arguably fulfilling its obligations under WHS legislation by banning nut products if that is what a risk assessment indicates. It may also be necessary to ban milk products if that is required for your daughter's safety. If (and I do not know) nuts pose a greater risk than milk then banning the former and not the latter may be perfectly justified. Ask to see the risk assessment.
The law on the web page is not current: as of the beginning of the year, RCW 23.86.030(1) reads (you'll find this under Sec. 9103) "The name of any association subject to this chapter must comply with part I, Article 3 of this act" and is otherwise unchanged. In Article 3, sec. 1301 governs names, giving the sec'y some discretion to deem a name to not be distinguishable from another, saying in (3) "A name may not be considered distinguishable on the records of the secretary of state from the name of another entity by virtue of...variation in the words, phrases, or abbreviations indicating the type of entity, such as "corporation," "corp.," "incorporated," "Inc.,". It does not list "co-op", but there is no legal requirement that the list be exhaustive. This discretion is, however, related to distinguishability. However, (4) then says An entity name may not contain language stating or implying that the entity is organized for a purpose other than those permitted by the entity's public organic record. and I think that means "no". Note that LLCs, LPs, LLPs, business corporations, nonprofit corporations and cooperative associations all have name requirements of the type "must contain" and "may not contain" (a cooperative association, oddly, has no "must contain" requirements). I would say that we have to conclude that "legislative intent" was to more closely align names and legal status, and the new "purpose-implication" language isn't brilliantly clear, but that is what the intent of the law is. This is one of those issues that could easily work its way to the Supreme Court, if someone wanted to make a state case of it.
Without the patient's permission, the doctor cannot legally share the patient's health information with the patient's employer. Your Rights Under HIPAA: [...] without your authorization, your provider generally cannot [...] give your information to your employer Remedies for confidentiality violations include civil actions, administrative fines, and criminal charges. (Remedies for Violation of HIPAA Privacy Rights and Medical Confidentiality, HIPAA Violations and Enforcement, What is the Penalty for a HIPAA Violation) Individual states also have confidentiality laws that are violated by the hypothetical in the question.
Health care providers in the US may send protected patient records to other health care providers for the purposes of treatment, either of the patient whose information it was or of a different patient (for instance, a doctor could send a chart of a different patient with a similar issue). This can be done without patient authorization, except for two cases: if the patient has requested more restrictions on use of their information and the provider agreed to those restrictions, and with psychotherapy notes. Source: HHS. WhatsApp specifically does not appear to be compliant with HIPAA, which is the US medical privacy law. However, there are many similar systems that are compliant. The body of your question asks about taking a smartphone screenshot; with many secure messaging systems, this is perfectly acceptable, and the principle of a doctor consulting with another doctor about a patient is actually encouraged. HIPAA violations do not by themselves result in any action against a medical license, nor can anyone besides the US government file suit based on a violation (everyone else is limited to complaining to the US government). Private lawsuits and (especially) license consequences are determined by state law, and are state- and situation-dependent. A doctor who calls a press conference to announce that this patient of his has HIV is more likely to face sanctions than a doctor whose violation was just not using a secure enough messaging client. HIPAA violations like this are not that uncommon, and generally result in at most a fine against the practice.
The state health codes applicable to food are here esp. ch. V and here. The primary focus of those health codes is preventing the introduction of toxic substances or pathogens. There is obviously no law against serving meat, nor is there any law against half-and-half pizza. The only possible prospect for a health law addressing your interest would be via the allergy avenue (yes, you do not allege to be allergic to anything – my point is that even if you did, this would not help your cause). There are some provisions regarding training and informing when it comes to "major food allergens", which however is defined as Milk, EGG, FISH (such as bass, flounder, cod, and including crustacean shellfish such as crab, lobster, or shrimp), tree nuts (such as almonds, pecans, or walnuts), wheat, peanuts, and soybeans or proteins derived from the above. Note that mammal meat is not included (it may be an individual allergen, but it is not a statutory major food allergen). Even if you wanted to sue, you would have a very hard time establishing that you were damaged. First you would have to establish that they have a legal obligation to serve you "vegetarian food" (crucially undefined). You might be able to establish that they made such a promise. Now we have to determine whether a reasonable person would conclude that a pie with half-meat and half non-meat is clearly not vegetarian food. I do not believe that there is secular case law addressing this, so the courts would resolve this by determining whether there is a reasonable means for a vegetarian to eat part of such a pizza – obviously, yes, only eat the cheese part (leave wide margins). So there is no legal recourse for getting what you want: there are still ample political options.
The line they'll rely on for GDPR compliance is the first part of that sentence - "If you agree to this during the order process", which suggests that there will be a separate request to opt in to marketing communications at some other time in the process. Check any order documents. There's likely to be a tick box or similar on at least one. If that implies opting out rather than opting in there may be grounds to argue with that under GDPR, but there's nothing in the quoted text that suggests a problem.
Laws against such actions are not stated in terms of popular and fluid concepts like "computer virus", they are stated in terms of clear concepts like "unauthorized access". There are federal and state laws against this. This web site lists and links to all of the state laws on the matter. There is also a federal law: a detailed legal analysis by DOJ is given here. There are some limits to federal jurisdiction, for example "protected computers" include "computers used in or affecting interstate or foreign commerce or communication". The term "affecting interstate or foreign commerce or communication" is widely used in federal law, and can be used to prohibit growing feed for your own animals. Anything that you "send" clearly affects interstate commerce (the internet is internationally connected). 18 USC 1030(a) says Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains...(C) information from any protected computer Essentially, a computer connected to the outside world is protected. The key here is "without authorization". If you authorize MS to report back stuff about your computer, that is not unauthorized. It may not be possible to use their product without giving such authorization, in which case you can use a different product that doesn't require that you grant authorization. There is also the possibility that some software producer has technically violates the law because they think that it's okay for them to access the computer as long as they do no harm. Typically, people are not aware that they have granted software publishers access to their computer. The concept of "harm" is pretty much irrelevant to computer-crime criminal law. It would be relevant, though, if a plaintiff were to sue someone for sniffing around their computer: then you'd have to show that you were damaged.