While the data itself would fit the description of PHI, I don't know if healthcare.gov itself qualifies since it isn't a "health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse". That doesn't mean that it's against best practices. I built an analytics platform for a project with the VA on https://catalyze.io/baas (I also work there), so their are some alternatives to analytics when HIPAA is a concern.
It could depend on whether healthcare.gov signed Business Associate Agreements (BAAs) with the insurers that it's connecting to. If it did have to sign BAAs, then heathcare.gov would be covered under the scope of those BAAs, and would likely have to be complying with the security rule and the privacy rule.
Don't governments always write themselves an exemption from following laws for everyone else? I imagine they are exempt by law from things that would land others in court or jail.
When I worked as a researcher the NIH, we took privacy very seriously, as we were liable for information leakage caused by our negligence. The federal government is liable for HIPPA violations.
The user's IP address (which I imagine gets collected by doubleclick) is one of the 18 identifiable attributes which makes data PHI. But, I don't think that healthcare.gov needs to comply by HIPAA.
Comments
Isn't this a HIPAA violation?
While the data itself would fit the description of PHI, I don't know if healthcare.gov itself qualifies since it isn't a "health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse". That doesn't mean that it's against best practices. I built an analytics platform for a project with the VA on https://catalyze.io/baas (I also work there), so their are some alternatives to analytics when HIPAA is a concern.
It could depend on whether healthcare.gov signed Business Associate Agreements (BAAs) with the insurers that it's connecting to. If it did have to sign BAAs, then heathcare.gov would be covered under the scope of those BAAs, and would likely have to be complying with the security rule and the privacy rule.
I think only lawyers can say since HIPAA seems like rather complex legislation. According to Wikipedia, PHI seems like it can be almost anything...
http://en.wikipedia.org/wiki/Protected_health_information
Don't governments always write themselves an exemption from following laws for everyone else? I imagine they are exempt by law from things that would land others in court or jail.
When I worked as a researcher the NIH, we took privacy very seriously, as we were liable for information leakage caused by our negligence. The federal government is liable for HIPPA violations.
Doesn't the federal government enjoy pretty nearly complete immunity from its own laws? In practice that seems to be the case, anyway.
No. I don't see any protected health information.
# of pregnancies is a violation. One could infer whether the individual is pregnant, has had a miscarriage or even an abortion.
The user's IP address (which I imagine gets collected by doubleclick) is one of the 18 identifiable attributes which makes data PHI. But, I don't think that healthcare.gov needs to comply by HIPAA.