In a nutshell, yes.
Problem 1. “Covered Entity.”
A Covered Entity is one of the following: A Health Care Provider, OR, A Health Plan, OR A Health Care Clearinghouse.
If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules. See definitions of “business associate” and “covered entity” at 45 CFR 160.103.
Problem 2. “No-private right of action.”
HIPAA doesn’t afford ANYONE a private right of action. You, as an individual, cannot bring a “HIPAA Claim” against ANYONE, INCLUDING a “covered-entity.” This has been litigated over and over and over again, with the same result.
Example:
“Significantly, however, there is no “private right of action to enforce HIPAA” when an individual believes that a disclosure was wrongfully made. Because the statute does not provide a private right of action, and “does not provide a remedy in court for those persons who believe their [HIPAA] rights have been violated,” Plaintiff is unable to state a cognizable claim for a HIPAA violation. Consequently, his claims for HIPAA violations are DISMISSED.” Emmerick v. Ridgecrest Reg’l Hosp., No. 1:17-cv-01160- DAD - JLT, 2018 U.S. Dist. LEXIS 21115, at *9 (E.D. Cal. Feb. 8, 2018).
“HIPAA prohibits the disclosure of medical records without a patient’s consent. But the statute does not expressly create a private cause of action for individuals to enforce this prohibition. Instead, HIPAA provides for penalties to be imposed by the Secretary of the Department of Health and Human Services. Nor does the statute imply a private cause of action. By delegating enforcement authority to the Secretary of the Department of Health and Human Services, the statute clearly reflects that Congress did not intend for HIPAA to create a private Accordingly, because HIPAA confers no private cause of action, express or implied, we must dismiss Meadows’ claims.” Meadows v. United Servs., 963 F.3d 240, 244 (2d Cir. 2020).
“Likewise, every circuit to have considered the issue has also held that no private right of action exists under HIPAA. See Meadows v. United Servs., Inc., 963 F.3d 240, 244 (2d Cir. 2020); Faber v. Ciox Health, LLC, 944 F.3d 593, 596-97 (6th Cir. 2019); Stewart v. Parkview Hosp., 940 F.3d 1013, 1015 (7th Cir. 2019); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010); United States v. Streich, 560 F.3d 926, 935 (9th Cir. 2009); Acara v. Banks, 470 F.3d 569, 570-71 (5th Cir. 2006). HIPAA generally prohibits the disclosure of medical records without a patient’s consent. See 42 U.S.C. §§ 1320d-1 to 1320d-7. While it provides civil penalties for improper disclosures of medical information, it does not expressly create a private cause of action to enforce the prohibition on disclosure. Instead, it limits enforcement of the statute to the Secretary of the Department of Health and Human Services. See 42 U.S.C. § 1320d-5. For that reason, no private right of action can be implied. “By delegating enforcement authority to the Secretary of the Department of Health and Human Services, the statute clearly reflects that Congress did not intend for HIPAA to create a private remedy.” Meadows, 963 F.3d at 244; see Alexander, 532 U.S. at 290 (”The express provision of one method of enforcing a substantive rule suggests that Congress intended to preclude others.”). Accordingly, Laster cannot state a claim to relief under HIPAA.” Laster v. Careconnect Health Inc., No. 20-14726, 2021 U.S. App. LEXIS 11481, at *5 (11th Cir. Apr. 20, 2021)
Problem 3. “Public Health Exceptions to HIPAA.”
Generally, disclosure of protected health information without the authorization of the individual is permitted for purposes including but not limited to: disclosures required by law (45 CFR § 164.512(a)) or
for “public health activities and purposes.” This includes disclosure to “a public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including but not limited to, the reporting of disease, injury, vital events…, and the conduct of public health surveillance,… investigations, and… interventions.” (45 CFR § 164.512(b)(i)).
Vaccine mandates, Vaccine passports and the rest of the tyrannical regulations that are being pushed are un-American and should be opposed by any and all means possible. They should be resisted, even to the point of civil disobedience. However, HIPAA isn’t the savior that people think that it is here. We need to push for State restrictions on “vaccine passports” and ignore other mandates.
Employers have no real way to check your vaccination status if you provide them a card. (Wink) and neither would Karen at the Walmart door.
All 100% correct.
If that wink means forging a CDC vaccination card that’s a felony no different than forging a social security card. Both are protected federal documents under numerous USC codes. The feds are ready and willing to start prosecuting those that do. Plus if fake cards become rampant it will virtually guarantee a block chain secured digital version is created that is impossible to forge and once that QR code and database is up and running the sky is the limit to how it will be used.
Relevant laws, that code is a ten year felony with loss of voting rights and firearms for life.
“The unauthorized use of an official government agency’s seal (such as HHS or the Centers for Disease Control and Prevention (CDC)) is a crime, and may be punishable under Title 18 United States Code, Section 1017, and other applicable laws.”