otterley 9 days ago

The site might be deemed a Business Associate, depending on the specific facts, which we don't fully possess. That's why I recommended the owner seek counsel.

Reply View 5 replies
  • roegerle 9 days ago

    A business associate to who? The user?

    Reply View 4 replies
    • bagels 8 days ago

      A covered entity (eg. doctor, nurse, etc.)

      Reply View 3 replies
      • yunwal 7 days ago

        How could this app possibly be considered a business associate to a provider? The provider has no idea it’s even being used, let alone a formal association with the application.

        Reply View 2 replies
daveguy 9 days ago

This is not true. I'm not a lawyer, but I am in the healthcare field.

HIPAA very much applies to this type of app or any other type of app that may deal in personally identifying information (PII) related to healthcare.

Reply View 2 replies
  • roegerle 9 days ago

    I was too.

    https://www.hhs.gov/hipaa/for-professionals/covered-entities...

    Reply View 1 reply
    • daveguy 8 days ago

      It would be a mistake to assume a SaaS that stores healthcare PII for coordinating healthcare is not covered under HIPAA. An exception should be filed at the very least.

      Edit: If no healthcare provider has access then maybe it could skate by. I interpreted "any user making notes to your account" to mean healthcare providers would have access. Even if not, they should still seek legal counsel. And this app is literally promising safety and security of healthcare information.

      Reply View 0 replies