We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other information recorded except for the resident's name. Would this alone cause our system to have to comply with all 54 items of the HIPAA Security Rule? I can't tell whether resident names, in this context, is considered "protected health information." Thanks!
2
-
That's a good question, but if I were you I'd check with a legal counselor– Lucas KauffmanCommented Jul 31, 2013 at 8:50
-
Imagine if you had a list of the names of everyone who attended the "Alzheimers Support Group Meeting". Your list would reveal the names of everyone who was there, which is basically the same as revealing who has Alzheimers.– LawtonCommented Jul 31, 2013 at 20:36
Add a comment
|
1 Answer
Assuming the subject of each event is medical, you're essentially mapping real names (which are considered identifying information, i.e. part of PII) to a medical subject that is likely relevant to their personal health issues. As such, I'd almost certainly say that you're falling into HIPAA territory, and should get everything checked out by a lawyer and the appropriate regulatory bodies.
answered Jul 31, 2013 at 9:15
