HIPAA Violation
02-13-2024, 11:22 AM
#2
Perennial Reserve
Joined APC: Jan 2018
Posts: 11,504
Originally Posted by DBCooperGA
OO and HIPAA Laws broken? Apparently it's a thing over there. Anyone have a story/info about?
Privacy Rule
The HIPAA Privacy Rule regulates the use and disclosure of protected health information (PHI) by "covered entities." These entities include health care clearinghouses, health insurers, employer-sponsored health plans, and medical providers. Upon request, covered entities must disclose PHI to an individual within 30 days. Entities mentioned earlier must provide and disclose PHI as required by law enforcement for the investigation of suspected child abuse.
The HIPAA Privacy Rule regulates the use and disclosure of protected health information (PHI) by "covered entities." These entities include health care clearinghouses, health insurers, employer-sponsored health plans, and medical providers. Upon request, covered entities must disclose PHI to an individual within 30 days. Entities mentioned earlier must provide and disclose PHI as required by law enforcement for the investigation of suspected child abuse.
- Covered entities may disclose PHI to law enforcement if requested to do so by court orders, court-ordered warrants, subpoenas, and administrative requests.
- A covered entity may reveal PHI to facilitate treatment, payment, or health care operations without a patient's written authorization.
- Any other disclosures of PHI require the covered entity to obtain prior written authorization.
- When a covered entity discloses PHI, it must make a reasonable effort to share only the minimum necessary information.
- The Privacy Rule gives individuals the right to demand that a covered entity correct any inaccurate PHI and take reasonable steps to ensure the confidentiality of communications with individuals.
- The Privacy Rule requires covered entities to notify individuals of PHI use, keep track of disclosures, and document privacy policies and procedures.
02-14-2024, 06:16 AM
#5
Gets Weekends Off
Joined APC: Feb 2008
Posts: 19,273
Originally Posted by rickair7777
Yeah hard to break a law that doesn't even apply to you.
02-14-2024, 06:25 AM
#6
Prime Minister/Moderator
Joined APC: Jan 2006
Position: Engines Turn Or People Swim
Posts: 39,293
Originally Posted by sailingfun
Not entirely true. Airlines have and can request health data. I had Delta airlines release health information on me that they required after a return to work from surgery. They we're definitely in violation of the law.
Law applies to health care providers, who generate or acquire your health info in their course of business.
DAL is not a healthcare provider, the only way they got your info is if YOU gave it to them. Not covered by HIPAA (might be some applicable state laws, more likely in CA than GA though).
Although if DAL was in the business of conducting FAA 1C medical exams with an in-house AME that might be different. But in this day and age anybody who even does that typically outsources to an actual healthcare provider (who could not share the info with any other party without your permission).
What did they do? Use the info to consult with the FAA?
02-14-2024, 06:34 AM
#7
Gets Weekends Off
Joined APC: Feb 2008
Posts: 19,273
Originally Posted by rickair7777
They probably were not.
Law applies to health care providers, who generate or acquire your health info in their course of business.
DAL is not a healthcare provider, the only way they got your info is if YOU gave it to them. Not covered by HIPAA (might be some applicable state laws, more likely in CA than GA though).
Although if DAL was in the business of conducting FAA 1C medical exams with an in-house AME that might be different. But in this day and age anybody who even does that typically outsources to an actual healthcare provider (who could not share the info with any other party without your permission).
What did they do? Use the info to consult with the FAA?
Law applies to health care providers, who generate or acquire your health info in their course of business.
DAL is not a healthcare provider, the only way they got your info is if YOU gave it to them. Not covered by HIPAA (might be some applicable state laws, more likely in CA than GA though).
Although if DAL was in the business of conducting FAA 1C medical exams with an in-house AME that might be different. But in this day and age anybody who even does that typically outsources to an actual healthcare provider (who could not share the info with any other party without your permission).
What did they do? Use the info to consult with the FAA?
I actually ended up with two different first class medicals from two different FAA sections. Not long after had the FAA show up and ask for credentials. I asked him which medical he wanted, my southern or northern medical! He was a bit perplexed!
02-14-2024, 07:03 AM
#8
Disinterested Third Party
Joined APC: Jun 2012
Posts: 6,026
That does sound like a nightmare, but not a HIPAA issue.
It's also a violation of FAA procedure on seeral levels, and certainly an ethical lase on the part of grand old Delta.
Of course, you worked through an attorney, your union, and a medical consultation service?
It's also a violation of FAA procedure on seeral levels, and certainly an ethical lase on the part of grand old Delta.
Of course, you worked through an attorney, your union, and a medical consultation service?
02-14-2024, 07:28 AM
#9
Gets Weekends Off
Joined APC: Feb 2008
Posts: 19,273
Originally Posted by JohnBurke
That does sound like a nightmare, but not a HIPAA issue.
It's also a violation of FAA procedure on seeral levels, and certainly an ethical lase on the part of grand old Delta.
Of course, you worked through an attorney, your union, and a medical consultation service?
It's also a violation of FAA procedure on seeral levels, and certainly an ethical lase on the part of grand old Delta.
Of course, you worked through an attorney, your union, and a medical consultation service?
02-14-2024, 07:38 AM
#10
Prime Minister/Moderator
Joined APC: Jan 2006
Position: Engines Turn Or People Swim
Posts: 39,293
Originally Posted by sailingfun
I was required to provide the data to Delta's health department
If they just asses employees fitness for duty, OJI claims, etc then they might not be a "health care provider". Even doing an FAA 1C exam could likely fall under "assessment", not "care".
Also would depend on the conditions under which you disclosed the info to DL, if there wasn't an actual or implied authorization to share that info it could be a violation... maybe that's what the lawyer was getting after. Again, varies by state.
HIPAA is like the 1st amemndent... you have to understand what exactly it means, and it's not intuitive. I belabor this for the benefit of others who might read this.
Thread
Thread Starter
Forum
Replies
Last Post
kymiller0593
Flight Schools and Training
2
12-16-2013 04:45 PM
