• Katana314@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    4 months ago

    HIPAA applies to whichever entity consciously chooses to move/store data.

    Generally, after a patient downloads a healthcare-related item, they are that entity - and as the patient, they have full control/decisions about where it goes, so they can’t violate their own HIPAA agreement even if they print it and scatter it to the wind.

    BUT, if your operating system “decides” to upload that document without the user’s involvement, then Microsoft is that entity - and having not received conscious permission from the patient, would be in violation. It’s an entirely different circumstance if the user is always going through clear prompts, but their more recent OneDrive Backup goal has been extremely forceful and easy to accidentally turn on - even to the point of being hard to disable. As you said, encryption has nothing to do with it.

    • ShortFuse@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      edit-2
      4 months ago

      No. Microsoft is not liable, at least when it applies to HIPAA.

      The HIPAA Rules apply to covered entities and business associates.

      Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules’ requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information. In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules.

      If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules. See definitions of “business associate” and “covered entity” at 45 CFR 160.103.

      https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html

    • lolcatnip@reddthat.com
      link
      fedilink
      English
      arrow-up
      2
      ·
      4 months ago

      LOL. You really think Microsoft doesn’t have an army of lawyers ensuring they comply with laws like HIPAA?

      • Katana314@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        4 months ago

        When they’re specifically writing business plans designed for hospitals, sure, they can likely account for it. But not when designing end user services that are laissez-faire about user data privacy - on the random things people put in “My Documents”. As with many organizations, it’s very possible the two parts of the corporation don’t talk to each other.

        • lolcatnip@reddthat.com
          link
          fedilink
          English
          arrow-up
          1
          ·
          4 months ago

          That’s not how it works. Microsoft knows Windows will be used in medical settings. They know “but it’s a product for home users” won’t be an effective defense if they cause a HIPAA violation.

          • Katana314@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            4 months ago

            They also should “know” that being forceful about backup prompts, AI features, and major version upgrades will irritate users into switching off their OS, and yet they’re doing it anyway. Logic is not driving their actions; greed for data is.

            • lolcatnip@reddthat.com
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              5
              ·
              4 months ago

              Microsoft makes is money by selling products and services. Your data is not nearly as valuable as you think it is.