Psycho-Babble Administration | about the operation of this site | Framed
This thread | Show all | Post follow-up | Start new thread | List of forums | Search | FAQ

Re: criminal case

Posted by ert on January 20, 2019, at 8:12:52

In reply to Re: criminal case, posted by ert on January 20, 2019, at 6:40:03

> In case of normal data the bar would be 1000$ for a criminal case, but here also is phi data (health data) involved that Hsiung steals (won't revoke their permissions), uploads and makes money with it. As far as I understand when phi data is sold or money is generated with third parties without authorization (such as a written authorization), there would be no bar to reach the limit to be a criminal case.

from hhs.gov

What is the difference between consent and authorization under the HIPAA Privacy Rule?
Answer:
The Privacy Rule permits, but does not require, a covered entity voluntarily to obtain patient consent for uses and disclosures of protected health information for treatment, payment, and health care operations. Covered entities that do so have complete discretion to design a process that best suits their needs.

By contrast, an authorization is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule. Where the Privacy Rule requires patient authorization, voluntary consent is not sufficient to permit a use or disclosure of protected health information unless it also satisfies the requirements of a valid authorization. An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations, or to disclose protected health information to a third party specified by the individual.

An authorization must specify a number of elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed. With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.



Share
Tweet  

Thread

 

Post a new follow-up

Your message only Include above post


Notify the administrators

They will then review this post with the posting guidelines in mind.

To contact them about something other than this post, please use this form instead.

 

Start a new thread

 
Google
dr-bob.org www
Search options and examples
[amazon] for
in

This thread | Show all | Post follow-up | Start new thread | FAQ
Psycho-Babble Administration | Framed

poster:ert thread:1102664
URL: http://www.dr-bob.org/babble/admin/20151112/msgs/1102879.html