> And if you share it willingly, and not for medical purposes, it doesn't mean that the person you shared it with suddenly has a higher burden of security/privacy with that info.
Almost but not quite. I came to comment on this bullet point in the article because misunderstanding about PHI is so prevalent its nearly a meme.
PHI doesn't have anything to do with willingness or sharing. PHI is not a meaningful term constructed of its component words - its a specific legal term under hipaa. Any (noncovered entity) company can ask you anything about your health and it doesn't matter - airlines, restaurants, event venues, etc. They're allowed and it doesn't have anything to do with hipaa and they are not collecting/storing PHI.
HIPAA applies specifically to covered entities under its law. Its basically health care providers and health insurance companies. If you aren't one of those covered entities and youre not telling that info to a covered entity, there is no PHI.
If you want to boycot somewhere asking about covid or whatever - get down with your bad self. It just doesn't have anything to do with HIPAA.