If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?
In any forum, people are aware (or at least, they ought to be aware) that anyone else with access to the forums will see their posting. So I see little expectation of privacy, and people must be careful of the information they divulge.
The reason why I ask is some of the requirements (encryption at rest) seem to defy common sense in an environment where anyone can gain access to the data for the low price of $15. At the same time, they make it harder for the system to function (ex: how can one search encrypted data; or what existing forum package even encrypts its data?).
At the same time, these are Doctors answering questions, publicly displayed though they may be. And from my reading "covered information" is a very broad term. Even the statement "I'm sick" appears to be covered information if I'm reading correctly.