Re:Breach exposed more than one million DNA profiles on a ma...
by johnnyballgame on Thursday July 23, 2020 @09:59AM
(#23927422)
"if insurance is never involved HIPAA doesn't apply."
No. This is just plain false.
HIPAA applies when personally identifiable health information is shared/exchanged. And it applies whether the data is electronic or physical (paper).
(I am NOT saying DNA falls within the HIPAA guidelines.)
Re:Breach exposed more than one million DNA profiles on a ma...
by astura on Thursday July 23, 2020 @10:07AM
(#23927488)
No, personally identifiable health information can be shared/exchanged without HIPAA applying. For example if I email my grandma information about my cancer diagnosis, Gmail isn't HIPAA compliant and doesn't need to be just because some people might use it to talk about their health. Grandma is also free to share my health information with impunity, she is free to, say, forward it to my boss because grandma doesn't have to abide by HIPAA either because she's a grandma.
Re:Breach exposed more than one million DNA profiles on a ma...
by johnnyballgame on Thursday July 23, 2020 @10:30AM
(#23927713)
Correct, you can personally share whatever information you like.
But a covered entity may not. And there are many covered entities which are not insurance related. That is all I was trying to say.
It's not, not even close, It's a law that very narrowly applies mainly to insurance companies and healthcare entities that accept medical insurance.
As a general rule - if insurance is never involved HIPAA doesn't apply.
If you got a DNA test prescribed by your doctor for a diagnosis or even for genetic counseling then HIPAA applies. It's not the nature of the data, it's the nature of the organization dealing with the data.
I have no idea where this mass misunderstanding came from