We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other information recorded except for the resident's name. Would this alone cause our system to have to comply with all 54 items of the HIPAA Security Rule? I can't tell whether resident names, in this context, is considered "protected health information." Thanks!
Assuming the subject of each event is medical, you're essentially mapping real names (which are considered identifying information, i.e. part of PII) to a medical subject that is likely relevant to their personal health issues. As such, I'd almost certainly say that you're falling into HIPAA territory, and should get everything checked out by a lawyer and the appropriate regulatory bodies.