I'm building a new website, and I'm trying to figure out if I need to worry about HIPAA. And if I do, I'm trying to figure out a way I can stop worrying about HIPAA. An example of something kinda similar, is the symptom checker on WebMD. You can put in some info that's considered personally identifiable, along with your symptoms. Then it gives you some possibly relevant medical information. But they have this disclaimer:

This tool does not provide medical advice It is intended for informational purposes only. It is not a substitute for professional medical advice, diagnosis or treatment. etc...

My question is, does that disclaimer make them immune to HIPAA? And if it does, would it still work if people had to pay to use it?

I'm just trying to get an idea what might be ok. I'll definitely do more research or ask a lawyer, if it seems like the right way to go.

edit: The first version of my site may not fall under HIPAA's rules. But if all goes well, I may add stuff, or have customers who are covered by HIPAA, that would require me to comply with HIPAA. So I'll build my site with HIPAA, and other similar legal complications in mind. Also, both answers and the discussion, were very helpful. And I can't really say which answer+discussion was more helpful. But I really should pick one, so I will. Thanks for the help!


2 Answers 2


I am not a lawyer. This is not legal advice.

That said such a site does not seem to be a health care provider, health (insurance) plan, health care clearinghouse, or a business associate of one. Therefore, HIPAA's rules do apply to your website. HIPAA's privacy rule only applies to health care providers, health plans, and health care clearinghouses and their business associates. If you are unsure of whether you are one of these groups, please consult the flowchart from CMS.gov (medicare) (link to page where the PDF is listed).

That said it is still a good idea to protect user's health care data as much as possible, and there are other privacy laws that may be relevant. For example, Europe has very strict privacy rules (even if they are rarely enforced).

Furthermore, you probably could be a covered entity and create a symptom checker that is HIPAA compliant, especially if the data is anonymous (e.g., not individually identifiable) OR the health care data is only being disclosed to the individual (or their personal representative) OR you have permission in writing from the individual to disclose their health information OR it falls under HIPAA's defined provision of "minimum necessary" use and disclosure (e.g., disclosed to your doctor, nurses, etc who are treating you, as well as health insurers or other people who need the information to properly bill you, etc.).

The reason you want that sort of "not medical advice ... for informational purposes only" disclaimer is not due to HIPAA. It is to limit being sued for medical malpractice.

If your health tool misdiagnoses someone -- e.g., "you have a common cold ... get bed rest" and it turns out the person had a MRSA infection and they ultimately died as they delayed treatment, someone may try and sue you. That sort of "informational" disclaimer may lessen your legal liability in some jurisdictions. That said in other jurisdictions, you may still be held liable for giving bad medical advice if your advice is demonstrably negligent, especially if the disclaimer was small print that's usually ignored or quickly clicked through in an unobtrusive manner or you were charging for the service or it was advertised/described elsewhere as providing medical advice.

  • I saw that flow chart before, but I still wasn't sure if I'd legally be considered a provider. I don't think I'd be, but I need to make sure. But the first link you gave had this: "but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." And that might work. I'll have to look into what those transactions are. Also, I'll be putting clearly visible warnings on the site about how the information could easily be wrong. It's purpose will be to point out possibilities they may not be aware of. Thanks.
    – Dan
    Oct 13, 2015 at 7:48
  • I might even be better off trying to market the idea to healthcare professionals, instead of directly to the general public. Or at least certain parts. But first, I need to deal with HIPAA.
    – Dan
    Oct 13, 2015 at 8:07
  • I looked at that flowchart at cms.gov again, and it has a note at the bottom describing "standard transactions" that I didn't see before. And AFAICT I won't be doing any of those. So that should take care of my HIPAA questions, at least for now. I'm assuming I can't become the business associate of a covered entity, without my consent.
    – Dan
    Oct 26, 2015 at 3:34

I would personally say contact a lawyer. From what I know of HIPAA I would say you could be treading dangerous grounds if you store their searches of symptoms in a way that is personally identifiable to the user. You don't want to all of a sudden have a database of potential medical details of an individual.

  • I'd rather have the users store their own data, so I can avoid all this. But I also want them to be able to easily access it from anywhere, so storing it myself is the obvious choice. I might be able to code the data in a way that removes the identifying parts, where only the user has the key for making them identifyable again, but that could get messy.
    – Dan
    Oct 13, 2015 at 18:50
  • You could have a very very good disclaimer I would imagine that could cover your bases but you would defiantly want a lawyer to review it. A search does not mean its relevant to someones personal health. But you would still need to be careful about storing data. I'm sure you can have the service you want, but I think you really need real legal advice. This is the kind of thing that you want to make sure you avoid HIPAA or can comply. Obviously you can offer the service, but how you do it and what and how you store data can be to important to not legally know for sure.
    – David-
    Oct 13, 2015 at 19:09
  • So I could use a disclaimer, and also build the site in a way I think is HIPAA compliant. Then I'll be learning more about HIPAA in the process, while also making the site more secure, which I want to do anyway. Then, by the time the site is getting close to done, I'll have a much better idea what I'm doing, and I can have a lawyer review anything I still have questions about. I'm mainly concerned right now, about getting started with building the site in a way that shouldn't trigger any legal issues. Dr jimbob mentioned European privacy rules, so I'll need to comply with more than just HIPAA.
    – Dan
    Oct 13, 2015 at 19:35
  • Yes, you could do that. Study along the way, do the best you can based on what you can learn about the laws and make sure you believe you are complying, but be wary about making the site public until you can have it professionally reviewed. It's for your safety. The kinds of lawsuits you could face making it public too soon are not worth it.
    – David-
    Oct 13, 2015 at 19:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .