Is an official patient/physician relationship required for HIPAA to apply?
<p>Inspired by a tweet I saw a moment ago:</p>
<p><a href="https://twitter.com/shanselman/status/1511783399580581888" rel="nofollow noreferrer">https://twitter.com/shanselman/status/1511783399580581888</a></p>
<blockquote>
<p>She's a nurse and not only do I know that her sister in law N**** is coming in from out of town, she had a BBL and is worried about leakage while on the plane. I think this is a Hipaa violation?</p>
</blockquote>
<p>Names censored.</p>
<p>In this case, does the profession of the lady talking about her sister in law, medical nurse, automatically mean that HIPAA applies and she is illegally sharing private medical data without patient consent? Or does HIPAA only apply to medical professionals when the data concerns that of one of their official patients?</p>

<p><a href="https://www.law.cornell.edu/cfr/text/45/164.502" rel="nofollow noreferrer">The rule</a> applies to &quot;A covered entity or business associate&quot;, who may not &quot;use or disclose protected health information&quot; except as permitted. The set of covered entities and business associates is pretty large, and certainly covers nurses, also secretaries working for the hospital or insurance company. It is not restricted to the doctor-patient relationship. However, the restriction is not absolute: a patient can consent to the disclosure of such information: but, the consent must be written.</p>
<p>This raises an interpretive challenge, in case patient A reveals a medical fact to a friend B who happens to be a medical professional. Person B probably is a &quot;covered entity&quot;, since they are undoubtedly</p>
<blockquote>
<p>A health care provider who transmits any health information in
electronic form in connection with a transaction covered by this
subchapter.</p>
</blockquote>
<p>The information also is &quot;protected&quot;:</p>
<blockquote>
<p>Protected health information means individually identifiable health
information: (1) Except as provided in paragraph (2) of this
definition, that is: (i) Transmitted by electronic media; (ii)
Maintained in electronic media; or (iii) Transmitted or maintained in
any other form or medium.
(2) Protected health information excludes individually identifiable
health information: (i) In education records covered by the Family
Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii)
In records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) In
employment records held by a covered entity in its role as employer;
and (iv) Regarding a person who has been deceased for more than 50
years.</p>
</blockquote>
<p>Para 5 on prohibited uses and disclosures explicitly lists the prohibited disclosures (genetic information for insurance underwriting, sale of PHI), so idle gossip is not explicitly prohibited. It is also not explicitly allowed. But again, the regulation says:</p>
<blockquote>
<p>may not use or disclose protected health information, except as
permitted or required by this subpart</p>
</blockquote>
<p>Nothing in the rules limits the obligation of a &quot;covered entity&quot;, in terms of how they came to be in possession of PHI. Given the definition of &quot;covered entity&quot;, the fact of being a covered entity is a property does not depend on obtaining information electronically. So without written consent, B who is a covered entity cannot gossip about A's medical status.</p>

hipaa