Is Princess bound by HIPAA?

[Loreni]

My understanding is that Princess is not bound by many US employment or tax laws, so are they required to keep our medical information confidential?  
 

Even if they are,  there could be a security breach as there was with our passport and credit card information.  We also know Princess/ CCL doesn’t always follow regulations.  The “magic pipe” comes to mind and I believe there was also discharge in Alaska (some  believe they view the fines as a cost of doing business).  Maybe potential exposure of our medical information is just another risk we need to weigh while we wait for the vaccine so cruising can get back to normal.

[Outerdog]

HIPAA is very specific as to the entities which are covered by the regulation. Covered entities under HIPAA include health plans, healthcare providers, and healthcare clearinghouses. Health plans include health insurance companies, health maintenance organizations, government programs that pay for healthcare (Medicare for example), and military and veterans' health programs.

 

 

[Hlitner]

An interesting question.  One of my many hats, when working for a government medical insurance agency, was as a HIPAA Compliance Officer who had to answer many strange HIPAA questions.  I do not think that one could make a case to enforce HIPAA against any foreign registered cruise line.  A possible exception might be if medical info was released while a ship was in US waters, but even that would be a stretch since cruise ship medical facilities are not even licensed in the USA.

 

One caveat.  If there were communications (electronic or written) between a ship's medical folks and a US insurance company or a US attorney that info would still be bound by HIPAA requirements.

 

Hank

[npcl]

While this is certainly a gray area the US headquartered cruise lines companies have certainly been willing to bring it up as a reason why they cannot release medical information.

 

You also have the legal precedent by the supreme court in 2005 concerning the ability of people to sue cruise lines in US waters, for failure to follow the ADA.  From that one would think that if it came to it that a similar ruling might occur under a HIPAA violation case.

 

Now if the ship is in a US port, and someone was treated in a medical center would HIPAA apply? Logic would indicate that it would since at that point it would be a covered entity. A medical facility inside of the US.

 

For cruise ships not touching US waters it most likely would not apply.  However, since the major cruise lines headquarters are located inside the US and since any such billing information would pass through a US facility one could make the argument that it would apply to those cases as well.

 

I suspect that based upon a number of reasons, that procedures for the US headquartered lines are set up to follow HIPPA, even if the enforcement of it is a rather gray area.

[SharkieRools]

1 hour ago, Loreni said:

Maybe potential exposure of our medical information is just another risk we need to weigh while we wait for the vaccine so cruising can get back to normal.

Seems to me that like coronavirus the risk isn't limited to just Princess or cruising in general.  Any entity that has your medical information could potentially be hacked, including your medical group, hospitals, insurance companies, etc etc etc.