Read the law strictly enough and you can put health information in the file name and now you’ve forced Facebook to deal with HIPAA.
That’s taking it to the extreme, but it’s technically correct.
That’s taking it to the extreme, but it’s technically correct.
If you say “Read the law strictly enough” please do...
I'm still wondering, because Backblaze will sign a BAA (their website says so), making them a business associate. I'm not talking about some private person uploading their own documents. My concern is that given that Backblaze will sign a BAA, then some companies must be using Backblaze and potentially storing PHI data there. Yes?
Backblaze then need to follow: "§ 164.312 Technical safeguards. (e)(1) Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network."
Facebook isn't authorized to access this data, but that might be more of a problem for Backblaze, even if Facebook could be required to delete the data.