HIPAA compliancy

Your question raises a lot of interesting issues. Depends on the facts involved, there may be a privacy issue (particularly if inadequate security measures are not used to ensure that protected health information is not secured in a reasonable fashion under the circumstances). Here is a bit of a long explanation, which is somewhat due to the complexity of the HIPAA regulations and the myriad of issues and problems encountered in daily practice. The federal privacy regulations implemented by the U.S. Department of Health and Human Services commonly known as "HIPAA" generally exempt three large categories of common activities from its privacy requirements--namely, Treatment, Payment, and Operations ("TPO"). In addition, there are security rules designed to prevent privileged information about a patient (so-called Personal Health Information or "PHI" in HIPAA-speak") from getting into the wrong hands. Covered entities can use and disclose PHI as reasonably necessary for Treatment, Payment, and health care Operations. And, since many of these entities rely upon others to assist them, they are required by HIPAA to enter into so-called "Business Associate Agreements" which require such contractors to provide written assurances that they will abide by HIPAA's confidentiality requirements--meaning they may not use or disclose protected health or mental health information without authorization, or waiver of authorization, subject to limited exceptions. See 45 C.F.R. § 164.502(e)(1). This answer does not, nor is it intended to create an attorney-client relationship, but is offered solely for information purposes. Since the facts of each case are different, it is important to seek out qualified counsel with whom information can be shared and assessed under an attorney-client privilege so that competent and tailored advice can be provided.


HIPAA is a highly technical regime, but

A forum like this is only useful for exploring in an educational way similar concerns by others; and not for obtaining a legal opinion or a reliable answer specific to your facts. Thus, it isn't possible to answer your question in any meaningful way. But your question does trigger a number of additional questions and thoughts.

For one, a close examination of your state law on health and medical record privacy would also be in order. HIPAA is a federal scheme and it is not a "Best Practices" guide, but more of a minimum requirements or floor for a very narrow and specific type of medical records, personally identifiable health information (PHI). The states are free to adopt heightened protections. Examples in Georgia Law would include certain data and records containing mental health treatment, HIV/AIDS records, Alcohol Abuse treatment records, among others.

Further, as mentioned in an earlier comment about your question, there are many exceptions to the HIPAA regulations in the hundred plus pages of those regulations. There is some suggestion that reasonable and practical real-world experience should guide the courts in the application of the privacy rules in HIPAA. For example, healthcare providers can contract with others in the delivery of service who might have access to PHI. One immediate example would be the transcription service that types the medical record typed by the healthcare worker. Arguably, so long as a written "Business Partner" agreement is in place such an arrangement would likely meet the minimum requirements of the HIPAA laws and implementing regulations.

Note: This Answer and any information contained in this answer is not intended to be treated as legal advice, but is offered solely for information purposes; And, this posting does not create an attorney-client relationship or privacy privilege of any kind. This attorney licensed only in Georgia.

Nothing in HIPAA prohibits the use of hand held recorders.