The latest law, The Health Insurance Portability and Accountability Act of 1996 (HIPAA) [1], has even strictor rules on handling health information.
DIVE OPS, take note! -- better have this stuff locked away, not in some accessable filing cabinet.
[1] Understanding Health Information Privacy
Please let's not go down the HIPAA road again; it does not cover dive shops.
Please follow the link you provided and you'll see:
The Privacy and Security Rules apply only to covered entities. Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules' requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If an entity is not a covered entity, it does not have to comply with the Privacy Rule or the Security Rule.
A Covered Entity is one of the following:
- A Health Care Provider
- A Health Plan
- A Health Care Clearinghouse
Are you a covered entity?
Dive shops, dive instructors, training agencies, etc are NOT covered entities; therefor do NOT have to comply with HIPAA.
Am I saying that they should therefore release your records to the world? No. But misapplication of laws that are very specific and very clear is not a great way to bolster your position, it only weakens it.