Sony Entertainment’s cyber breach reveal of massive health related information of their employees struck a new, major chord. But are they covered by HIPAA? Opinions by respected legal authorities are all over the map. (UPDATE: they appear to be self-insured, therefore a HIPAA CE… let’s see what the day brings on this ever-changing story.)
Let’s review: a HIPAA “covered entity” is a provider of healthcare, a payer of healthcare (i.e., the insurance company), or a processor of healthcare information (clearinghouse, data storage, and now, health exchanges) … or a business associate, in a recent, sweeping change in the law. “Employers” are not, simply by virtue of sponsoring health insurance, covered entities, and aren’t traditionally liable under HIPAA unless they are also practitioners providing their own health care, or are large enough to be self-insuring which may be the case with Sony. Their letter, linked above, apparently admits as much, referencing “SPE health plans.” (And a more recently found link to the SPE Health Plan privacy notification would seem to confirm it. – thank you, databreaches.net!)
But raw stupidity is rampant in this case. Many companies make assumptions that they are covered entities when indeed, they are not … and assuming Sony’s breach letter writer didn’t accidentally redefine their lawful role is pouring a lot of confidence in a mighty leaky pitcher. ‘Twere written as a movie script, it would get laughed out Sony Pictures offices!
At the same time, clarity isn’t yet assured… a quick morning review shows Yea , Nay; and most important, Maybe … “While the industry debates whether Sony and all other employers are covered entities under HIPAA…” (emphasis mine).
This would be the most mind-blowing of all aspects. Employers being considered “covered entities” would be a tectonic shift across all businesses. Also pertinent is the recent Connecticut SC decision to allow HIPAA negligence standards to serve as the standard for private right of action.
Keep watching the sky on this story … fallout is only just beginning.