Good evening! I can help you out with your legal question tonight. Yes, you cannot disclose what their diagnosis is without first obtaining a HIPAA consent form executed by each.

Not only can you and your non-profit get penalized for violating HIPAA, but also the hospital that you are working with to get that information.

Here is a sample form you can base your release on:

http://www.state.nj.us/treasury/pensions/epbam/exhibits/pdf/mi0827.pdf

Yes, you still need to be compliant. So if they are filling out the information online, you can build in a waiver to the online form.

Yes, you should do an electronic consent form so that you protect yourself.

You are very welcome and good luck with your project. Have a good night and please accept so that I can continue to help others.

Did you have any other questions?

The only "entity" that you could fit into, is the "healthcare clearinghouse." While you have an argument that you don't fall into it, a Plaintiff has an argument that you do. Especially if they show you have any communication with a hospital as you stated in your question.

I agree with you though, you probably won't be considered a covered entity, but lawyers expect the worst (that you will be sued for HIPAA violations) and hope for the best.

The diagnosis is the private information, not so much the name, although there have been cases where the names of the patients are also protected.

The law just says names are XXXXXXXXX, XX it could mean either first or second.

Again though, these are all arguments, but the clearer and more precautions you take now, the less likely litigation will be in the future.

Yes, identifiable information can be a first name. A good example of this is if a co-worker tells his/her boss that he/she is going to the hospital for a child's treatment. The co-worker could then go to your site and hospital and see what the diagnosis is or whatever information you put on the site. While only a first name is XXXX, XXXX would have a great argument that you violated their privacy and the judge would likely rule against you.

If you get information from hospitals they could try and lump you into being a covered entity, but I personally don't think you are a covered entity at all.

But the whole job for an attorney is to tell you the risks. I'm saying that while I don't think HIPAA controls you, an argument could be made that it does if you get information from hospitals and/or use patients' names.