Replies

I still have to disagree. HIPAA does not apply to newspapers unless they become a covered entity or a business associate. There are other state and federal privacy laws that may apply, but not HIPAA.

The penalty provision apply to any person who violates the provisions "of this part." The part (the administrative simplification provisions) applies only to covered entities and business associates.

Individually identifiable health information that was initially disclosed in violation of HIPAA doesn't carry a taint with it that follows to each recipient.

In December 2002, HHS issues FAQ confirming that the privacy rule applies only to covered entities and business associates. HHS stated that "the law does not give the Department of Health and Human Services (HHS) the authority to regulate other types of private businesses or public agencies through this regulation."

In 2004's University of Colorado Hospital Authority v. The Denver Publishing Co, a federal judge ruled that a newspaper that published PHI in a peer review report obtained in violation of HIPAA could not be sued directly because HIPAA did not establish a personal cause of action. That was already known, because the commentary accompanying publication of the regulations, and publications issued by the DoJ, told us that. However, the judge also denied motions against the newspaper on the grounds that it was not a covered entity nor a business association and could not have violated HIPAA's disclosure rules.

We should probably take any further discussion of this private, as I imagine everyone else would get tired of it. Certainly, individuals in the health provider, claims processing, and insurance industries, and lawyers, aren't the only ones who understand HIPAA, but I'm curious about the base of knowledge from which you're arguing these points. Curious, simply because if I'm wrong in these areas (and if I've been wrong for several years now), then I'd like to know. HIPAA has been a primary part of my practice throughout the development of the administrative simplification rules (strange name for privacy rules, isn't it?).

What is your source for saying HIPAA rules can't be washed like drug money, longtermmemmory? And, airedale, even though it's an arcane part of drafting, do you see how a statement that HIPAA applies to "each person" may mean less than each person when it talks about violating "this part," and "this part" only applies to a certain group of people?