united-states hipaa
Does HIPAA apply to independent doctor with no links to Medicare or other medical organization?
<p>When I spoke with my family doctor he was under the impression that HIPAA privacy rules applied to EVERY doctor or health care provider. Also a professor who teaches classes for emergency medical responders said the same thing.</p>

<p><a href="https://www.gpo.gov/fdsys/pkg/PLAW-104publ191/html/PLAW-104publ191.htm" rel="nofollow noreferrer">HIPAA law</a> says this:</p>

<blockquote>
  <p><a href="http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-1&amp;num=0&amp;edition=prelim#sourcecredit" rel="nofollow noreferrer">42 USC 1320d-1: General requirements for adoption of standards</a>
   a) Applicability: Any standard adopted under this part shall apply, in whole or in part, to the following persons:</p>
  
  <ol>
  <li>A health plan. </li>
  <li>A health care clearinghouse.</li>
  <li>A health care provider who transmits any health information in <strong>electronic
  form</strong> in connection with a transaction referred to in section 1320d–2(a)(1) of this title.</li>
  </ol>
</blockquote>

<p><a href="https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf" rel="nofollow noreferrer">HIPAA Administrative Simplification Regulation Text</a> expands it to associates:</p>

<blockquote>
  <p>§ 160.102 Applicability.</p>
  
  <p>(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this subchapter
  apply to the following entities: </p>
  
  <ol>
  <li>A health plan.</li>
  <li>A health care clearinghouse.</li>
  <li>A health care provider who transmits any health information in <strong>electronic form</strong> in connection with a transaction covered by this subchapter.</li>
  </ol>
  
  <p>(b) Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate. </p>
</blockquote>

<p>It seems clear that this DOES NOT apply to my doctor. He has no contract with Medicare or any other health care organization (cannot be called a business associate). He does not transmit PHI (Private Health Information) in electronic form. He does not take insurance. HIPAA only regulates those who send information electronically. It does not regulate everyone. </p>

<p>This situation may be rare in our modern world but it happens. So who is wrong: me or the doctor?</p>

<p>I tried hard to make the doctor subject to the rules, but really couldn't. He would have to be</p>

<blockquote>
  <p>(3) A health care provider who transmits any health information in
  electronic form in connection with a transaction covered by this
  subchapter.</p>
</blockquote>

<p>or, for some purposes, a "business associate". The <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=cfe5bf61a546f1390c1a196b573f71fb&amp;mc=true&amp;node=se45.1.160_1103&amp;rgn=div8" rel="nofollow noreferrer">law does not define</a> transmiting in electronic form, but it does define "Electronic media" to include "Transmission media used to exchange information already in electronic storage media". Crucially, though,</p>

<blockquote>
  <p>Certain transmissions, including of paper, via facsimile, and of
  voice, via telephone, are not considered to be transmissions via
  electronic media if the information being exchanged did not exist in
  electronic form immediately before the transmission</p>
</blockquote>

<p>So making a VOIP phone call would not count. But: if the doctor has computer files, and may read some such information over ordinary land lines, that constitutes exchange of information already in electronic storage media. If the doctor only has paper records, then his transactions are not covered, unless he happens to be a business associate. However, accepting a referral from a covered entity does not make you a covered entity: a business associate specifically does not include</p>

<blockquote>
  <p>A health care provider, with respect to disclosures by a covered
  entity to the health care provider concerning the treatment of the
  individual</p>
</blockquote>

<p>so he appears to not be covered at least by this portion of HIPAA (Title II). This all presumes that there are no state requirements to obey HIPAA.</p>
