On: Automakers are sharing consumers' driving behavior...

[warkdarrior]

Depends who is selling that data. Some pharmacy delivery services or billing services may not be covered by HIPAA, since they are not necessarily "covered entities".

[ethbr1 → warkdarrior]

Is this true?

My understanding of HIPAA (possibly incorrect) is that it's attached to the data.

If a covered provider is leaking HIPAA covered data to a non-covered business associate entity... that's a big no-no and a fine.

[snowwrestler → ethbr1]

There are criteria for which organizations are covered by HIPAA’s privacy protections. It is not attached to the data wherever the data goes.

[ethbr1 → snowwrestler]

Yes, those are covered entities. Their subcontractors who touch HIPAA data are business associates.

See https://www.hhs.gov/hipaa/for-professionals/covered-entities... and https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-...

In my experience, covered entities are really serious about signing BAAs with any of their hosting vendors and partners, as afaik the liability falls on the covered entity if they didn't have an agreement in place and data leaked from a vendor/partner.