# HIPAA Question **URL:** \ **Category:** In My Humble Opinion\ **Created:** [January 28, 2016, 3:10am UTC](https://boards.straightdope.com/t/hipaa-question/744460 "2016-01-28T03:10:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![joe.russell](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@joe.russell](https://boards.straightdope.com/u/joe.russell)\ **Post date:** [January 28, 2016, 3:10am UTC](https://boards.straightdope.com/t/hipaa-question/744460/1 "2016-01-28T03:10:13Z")
Heres the scenario. I post a review, publicly, for a business on facebook saying my wife was seen by so and so The business responds, publicly, saying I saw your wife in sept of 2014, without saying her name. I had not previously mentioned the date. This is an eyecare place, if that makes a difference, and although he didnt mention my wifes name, he mentioned that she was the sister of… ‘jane doe’. Is that a hippa violation? ---
**Author:** ![Colibri](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/colibri/32/1841_2.png) [@Colibri](https://boards.straightdope.com/u/Colibri)\ **Post date:** [January 28, 2016, 3:22am UTC](https://boards.straightdope.com/t/hipaa-question/744460/2 "2016-01-28T03:22:47Z")
Legal questions are best suited to IMHO. I also fixed the acronym in the title. Colibri General Questions Moderator ---
**Author:** ![joe.russell](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@joe.russell](https://boards.straightdope.com/u/joe.russell)\ **Post date:** [January 28, 2016, 3:26am UTC](https://boards.straightdope.com/t/hipaa-question/744460/3 "2016-01-28T03:26:46Z")
Thank you. Sorry about the wrong thread. I missed my edit window, but the way I see it is he is providing information, when she was seen, that wasnt provided by me And also providing ‘personal identifiers’ by saying its ‘jane does’ sister. ---
**Author:** ![WhyNot](https://avatars.discourse-cdn.com/v4/letter/w/c77e96/32.png) [@WhyNot](https://boards.straightdope.com/u/WhyNot)\ **Post date:** [January 28, 2016, 4:17am UTC](https://boards.straightdope.com/t/hipaa-question/744460/4 "2016-01-28T04:17:20Z")
Yes, actually. This might be the first time ever that an “is this a HIPAA violation?” question actually was a HIPAA violation. Date of service, except for just the year, is considered Protected health information (PHI). > [@](#): > > PHI includes all individually identifiable health information (including information in research databases and tissue bank samples with identifiers) relating to the: > Past, present, or future physical or mental condition of an individual > Provision of health care to an individual > Past, present or future payment for the provision of health care to an individual > > Health information is individually identifiable if it contains any of the following: > Names > Geographic subdivisions smaller than a state > \*\*Dates \*\*(except year) directly related to an individual, including birth date, health care \*\*service \*\*admission or discharge dates, date of death, and all ages over 89 and all elements of dates (including year) indicative of such age, unless aggregated into a single category of ages over 89 > … [https://acp.stanford.edu/hipaa/hipaa-faq](https://acp.stanford.edu/hipaa/hipaa-faq) (Bolding mine) “Jane Doe’s sister” is not PHI, oddly enough, although in a practical sense, it’s much more useful for identifying someone than the service date. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [January 28, 2016, 4:19am UTC](https://boards.straightdope.com/t/hipaa-question/744460/5 "2016-01-28T04:19:00Z")
It depends on the particular business. An ‘eyecare center’ could take many forms. However, if they have an optometrist and they submit insurance claims electronically then they’re probably a covered entity and revealing your wife’s sister’s name is probably a violation. There are a lot of details to every part of that. ---
**Author:** ![keturah](https://avatars.discourse-cdn.com/v4/letter/k/e95f7d/32.png) [@keturah](https://boards.straightdope.com/u/keturah)\ **Post date:** [January 28, 2016, 4:28am UTC](https://boards.straightdope.com/t/hipaa-question/744460/6 "2016-01-28T04:28:10Z")
> [@WhyNot](#): > > Yes, actually. This might be the first time ever that an “is this a HIPAA violation?” question actually was a HIPAA violation. Date of service, except for just the year, is considered Protected health information (PHI). > > [https://acp.stanford.edu/hipaa/hipaa-faq](https://acp.stanford.edu/hipaa/hipaa-faq) > > (Bolding mine) > > “Jane Doe’s sister” is not PHI, oddly enough, although in a practical sense, it’s much more useful for identifying someone than the service date. Naming the sister is also clearly a violation in spirit, if not the letter of the law. ---
**Author:** ![joe.russell](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@joe.russell](https://boards.straightdope.com/u/joe.russell)\ **Post date:** [January 28, 2016, 4:31am UTC](https://boards.straightdope.com/t/hipaa-question/744460/7 "2016-01-28T04:31:43Z")
Yes. This eye care center has an optometrist, and they do file insurance claims electronically. Any advice as to how to document this is appreciated. Currently I just have screen shots on my email ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [January 28, 2016, 5:31am UTC](https://boards.straightdope.com/t/hipaa-question/744460/8 "2016-01-28T05:31:17Z")
[You can file a complaint online.](https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf) You said it was on Facebook, that would be your evidence. ---
**Author:** ![ElderSign](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eldersign/32/8263_2.png) [@ElderSign](https://boards.straightdope.com/u/ElderSign)\ **Post date:** [January 28, 2016, 1:58pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/9 "2016-01-28T13:58:42Z")
Pursue this and report back here to follow up. I am curious. Good luck. ---
**Author:** ![Boyo\_Jim](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Boyo\_Jim](https://boards.straightdope.com/u/Boyo_Jim)\ **Post date:** [January 28, 2016, 7:11pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/10 "2016-01-28T19:11:20Z")
Any information a health care provider gives that could be reasonably used to identify an individual patient is a HIPAA violation – even if the only information is that she is their patient, regardless of the level of detail about her medical condition. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [January 28, 2016, 7:57pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/11 "2016-01-28T19:57:45Z")
> [@keturah](#): > > Naming the sister is also clearly a violation in spirit, if not the letter of the law. The “spirit of the law” is irrelevant, unless “Jane” is also a patient. ---
**Author:** ![joe.russell](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@joe.russell](https://boards.straightdope.com/u/joe.russell)\ **Post date:** [January 28, 2016, 8:53pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/12 "2016-01-28T20:53:33Z")
Thanks for the replies all! I havent fully decided what im going to do, as im not one to likes to drag things out and do court things. I have been talking with the owner privately, who was insistent that he has done nothing wrong since I ‘identified’ her prior, although only as my wife. He has not admitted wrongdoing, but has severely edited his response to include no personal indicators. Although I can tell he is starting to realize how serious his comments were Ive learned a lot from you all! Thanks! ---
**Author:** ![dizzee\_dee](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dizzee\_dee](https://boards.straightdope.com/u/dizzee_dee)\ **Post date:** [January 28, 2016, 8:55pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/13 "2016-01-28T20:55:36Z")
Not that it matters, because it seems clear that they did a HIPAA violation, but you kind of started it. If you didn’t want people to know your wife went there for her eyecare, why would you post exactly that? ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [January 28, 2016, 8:55pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/14 "2016-01-28T20:55:45Z")
> [@joe.russell](#): > > Thanks for the replies all! I havent fully decided what im going to do, as im not one to likes to drag things out and do court things. I have been talking with the owner privately, who was insistent that he has done nothing wrong since I ‘identified’ her prior, although only as my wife. He has not admitted wrongdoing, but has severely edited his response to include no personal indicators. Although I can tell he is starting to realize how serious his comments were > > Ive learned a lot from you all! Thanks! Did you identify yourself by name and then mention your wife? ---
**Author:** ![dizzee\_dee](https://avatars.discourse-cdn.com/v4/letter/d/7c8e57/32.png) [@dizzee\_dee](https://boards.straightdope.com/u/dizzee_dee)\ **Post date:** [January 28, 2016, 8:57pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/15 "2016-01-28T20:57:09Z")
> [@TriPolar](#): > > Did you identify yourself by name and then mention your wife? How else would they know the exact date of visit? ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [January 28, 2016, 9:00pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/16 "2016-01-28T21:00:55Z")
He might have described some sort of unusual eyeglass/contact prescription that the wife had. ---
**Author:** ![Boyo\_Jim](https://avatars.discourse-cdn.com/v4/letter/b/87869e/32.png) [@Boyo\_Jim](https://boards.straightdope.com/u/Boyo_Jim)\ **Post date:** [January 28, 2016, 9:01pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/17 "2016-01-28T21:01:26Z")
A spouse who is not a health care provider has no duty to maintain health care privacy under HIPAA. The health care provider does. ---
**Author:** ![stillownedbysetters](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@stillownedbysetters](https://boards.straightdope.com/u/stillownedbysetters)\ **Post date:** [January 28, 2016, 9:01pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/18 "2016-01-28T21:01:27Z")
HIPAA tends to be very generously interpreted by the courts. The release of inappropriate information by a medical provider doesn’t have to be egregious to be in violation for most cases. They are expected to know their responsibilities in this regard and are held to a higher standard than the general public would be. I tend to agree with dizzee dee in that, technically, you opened the door by mentioning your wife in connection with the clinic in the first place. But I’d still bet that their contribution of information would meet the standard of a HIPAA violation. Certainly nothing worthy of a big fine or other penalty, but it would likely merit at least a warning. ---
**Author:** ![TriPolar](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tripolar/32/3008_2.png) [@TriPolar](https://boards.straightdope.com/u/TriPolar)\ **Post date:** [January 28, 2016, 9:09pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/19 "2016-01-28T21:09:09Z")
This could still be a HIPAA violation, public knowledge doesn’t obviate a covered entity’s obligation to avoid release of private information. ---
**Author:** ![joe.russell](https://avatars.discourse-cdn.com/v4/letter/j/ecb155/32.png) [@joe.russell](https://boards.straightdope.com/u/joe.russell)\ **Post date:** [January 28, 2016, 9:14pm UTC](https://boards.straightdope.com/t/hipaa-question/744460/20 "2016-01-28T21:14:48Z")
My name is obviously attatched to my facebook, so its fair game. My wifes name is nowhere to be found on my page. The situation is actually more complicated bc ‘jane doe’, my sister in law, used to work there and hes wanting to group the review and her employement together. And he did provide ‘jane doe’s’ first and last name and with her relation to me, thus outing my wife. It was more of a matter that he was making a business matter, a personal matter. Again, I know its petty, but I was curious of the legality of the events that happened. At the very least ive learned a lot, and glad I dont have to follow hipaa rules! [Next page](https://boards.straightdope.com/t/hipaa-question/744460.md?page=2)