Comment by davismwfl | Hacker News Reader

Comment by davismwfl | Hacker News Reader

IANAL but I do work in a healthcare company and have worked in healthcare off and on for my career.

HIPAA does not prevent your employer from collecting this data, it only states (to a certain degree) how that data can be used, shared and what company policies & procedures are needed etc. In general right now though, the FDA, CMS and other enforcement agencies have suspended many of the penalties/rules around data collection, sharing, device usage etc. I am not aware of any laws that would prevent your employer from asking these questions or storing the data, but I would say it will make them subject to the rules of medical record storage as technically that data can identify you and is related to your health. If they shared this data without getting a release from you or had a database compromised then they could be subject to fines and other penalties, but I doubt any of that would be enforced over the next 6 months or so.

Many states are requiring employers to monitor/check employees that are on-site, but most are not storing the data as far as I know, so I doubt they are doing anything illegal or improper, maybe creepy but nothing technically wrong.

This is a good answer, thank you. Fundamentally, it feels wrong that they are storing my medical data without my voluntary consent. Based on your answer, it doesn't seem like the law supports my instinct.

HIPAA also only applies to covered entities and their business associates, of which the university most likely is not, or at least not in their capacity as OPs employer.

Mainly correct, HIPAA applies to carriers, health providers and healthcare vendors (even an ISP that stores data for a healthcare company) in general. However, there are exceptions where it applies to other organizations not directly in the care line.

In the OP's case it isn't so clear HIPAA doesn't apply, and IMO likely it may, because he works at a university and not a traditional private employer. If that university has a medical school or provides clinics to students/employees under the universities name (even contracted through a third party), then most legal advisors would say HIPAA rules must be followed. Also many states regulate the collection of health data by private employers, and with this being NYC who knows what is on the books.

I totally support a company wanting to do fever checks daily to prevent someone sick from entering the building while all this craziness is going on. But it gets creepy & frankly useless if they are relying on self-reporting and logging that to a database somewhere.

Reply on news.ycombinator.com