6

If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?

In any forum, people are aware (or at least, they ought to be aware) that anyone else with access to the forums will see their posting. So I see little expectation of privacy, and people must be careful of the information they divulge.

The reason why I ask is some of the requirements (encryption at rest) seem to defy common sense in an environment where anyone can gain access to the data for the low price of $15. At the same time, they make it harder for the system to function (ex: how can one search encrypted data; or what existing forum package even encrypts its data?).

At the same time, these are Doctors answering questions, publicly displayed though they may be. And from my reading "covered information" is a very broad term. Even the statement "I'm sick" appears to be covered information if I'm reading correctly.

Improve this question
2
  • 1
    This would be a good question for a Healthcare Industry stack exchange.
    – Oleksi
    Jul 21, 2012 at 22:27
  • I’m voting to close this question because it is regulatory, not security.
    – schroeder ♦
    Oct 14, 2020 at 15:02

3 Answers 3

Reset to default
4

The HIPAA Privacy Rule "regulates the use and disclosure of certain information held by "covered entities" (generally, health care clearinghouses, employer sponsored health plans, health insurers, and medical service providers that engage in certain transactions.)" Where a covered entity is a Health Care provider, a Health Plan, or a Health Care Clearinghouse. So the question is,

Are you a Covered Entity?

The site offers an Entity Chart .pdf for making that determination (it appears to be a flowchart of yes/no questions). Page 4 covers Clearinghouses - looking at the diagram, I'd say your website is probably not a "covered entity".

Naturally, I am not a lawyer, and you probably should consult a lawyer.

Improve this answer
1
  • I interpret the chart differently and say they fall under "Does the person, business, or agency furnish, bill or receive payment for, health care in the normal course of business?". Yes, then are a health care provider. Note the inclusive definition of health care which specifically includes: "Preventive, diagnostic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body;".
    – dr jimbob
    May 4, 2012 at 19:15
3

Forums that may connect accounts with sensitive patient health information and make them personally identifiable would fall under the definition of 'storing patient health information'.

You may find these resources useful: Who Needs to be HIPAA Compliant? HIPAA FAQ

Improve this answer
-3

This is really an important question and it deserves substantial consideration. When HIPAA refers to ‘certain information’, exactly, what are those precise stipulations?

In my limited opinion, it should be enough, for the sake of compliance, that the covered entity be transparent in its disclosure by asserting that “everyone can view information posted onto the World Wide Web and, by doing so, the person who posts has relinquished any claim to complete privacy and confidentiality.” Essentially– don’t post what you don’t want others to see.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.