Is there personally identifying info on CPAP SD cards?

[yaycpap]

Do CPAP SD cards have any personally identifiable information on them? If the info from the cards were analyzed by software on a computer or smartphone or on a website, would it be subject to HIPAA regulations? Or would HIPAA only apply if the information was being sent over the internet?

[justMongo]

The machine serial number is on the card. For most people that serial number is tied to their name.
The patient's name is generally in the analytic software. The software recognizes the flow generator serial number as belonging the the patient's name.
Keep in mind, I am not a lawyer...
Transmission over the internet would require encryption to be HIPPA compliant.
The entity that possesses the computer has a duty to protect data on that computer by using physical security; plus password protection; plus a duty to shred the hard drive when it's taken out of service.

[retired_guy]

My smartcard has puppy teeth-mark DNA on it. Does that count?

[justMongo]

My smartcard has puppy teeth-mark DNA on it. Does that count?

Some local jurisdictions are compelling Dog DNA be in their database.
Oregon being behind enemy lines, I'd say, you're in deep yogurt.

[Mark Douglas]

Not that this is on topic - but then maybe it is?
If you use a computer as an appliance but are curious as to the contents thereof download PhotoRec and play with it.
You deleted that private stuff on you computer? HAHAHAHA!
You are a hobbyist and formatted that hard drive, card, camera internal memory and now that stuff is gone? HAHAHAHA! silly goose.
I suspect if you do this you will never dispose of storage media again until you physically destroy it ever again.

(and yes in my lucid moments I know I am using a 'puter on the interweb so my life is an open book)

[trish6hundred]

Hi yaycpap,
WELCOME! to the forum.!
Hang in there for more responses to your post and much success to you with your CPAP therapy.

[archangle]

First off, HIPAA is not just a privacy thing.

However, let's consider the HIPAA privacy rules. The HIPAA privacy rules only apply to certain "covered entities."

http://www.hhs.gov/ocr/privacy/hipaa/und...index.html

Read the link, but it's healthcare providers, "Health Plan," and "Health Care Clearinghouses." The "Health Care Clearinghouse" is basically someone who works for one of the other defined "covered entities."

Of course the government and lawsuit lawyers always follow the rules, don't harass someone not covered by the rules.

Also, realize that even the government's web site has no legal bearing in court.

Internet experts' opinions don't count in court.

Even your own lawyer's opinion has no bearing in court, and your lawyer actually makes more money if you DO get sued.

[justMongo]

Dod requires a 7x overwrite on an HDD to assure erasure.
Some "Agencies" require the surface of the platters to be ground off.
That's time consuming and expensive; so, I know where there is a basement full of used HDDs.

[Mark Douglas]

Dod requires a 7x overwrite on an HDD to assure erasure.
Some "Agencies" require the surface of the platters to be ground off.
That's time consuming and expensive; so, I know where there is a basement full of used HDDs.

Remember all the noise when someone made it known photocopy machines sold off lease still had what they copied on the fixed disk? A deer slug does a pretty good job of pulverizing platter - so I heard

[archangle]

Dod requires a 7x overwrite on an HDD to assure erasure.
Some "Agencies" require the surface of the platters to be ground off.
That's time consuming and expensive; so, I know where there is a basement full of used HDDs.

That's an interesting subject, but I don't see how it relates to whether there is personally identifying information on an SD card.

Maybe we should start another thread about hard disk/SD card erasure. Maybe the OT forum.