real_dogbert

Of course putting ePHI in PowerPoint presentations should be against policy. The thing is, when it does happen, it's almost always inadvertent. Unfortunately, the "oops, my bad" defense isn't valid against violations of the HIPAA privacy rule.

G-Suite is a super interesting case in that you literally cannot use the product without handing over your data to Google. It certainly seems like companies would hate that, particularly those with data protection obligations. Google does theoretically require a Business Associate Agreement (BAA) if your use case is subject to HIPAA and you intend to store or transmit PHI using their services, but I don't know how they detect or enforce that. [1]

---

[1]: https://support.google.com/a/answer/3407054?hl=en

I wish I could disagree with you.

GDPR technically does have real teeth, to the extent that one really shouldn't want to raise the ire of an EU Data Protection Authority. Unfortunately, enforcement to date, and the resulting fines, have been lackluster at best. When will people learn that disincentives like fines and such have to actually hurt to be effective in changing the behavior of corporations?

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

By "participants who cannot legally enrol," do you mean minors? I'm not tracking what the Venn diagram between those people and those who "may not have the capacity to consent" is.