00:09
Adam Stofsky
A lot of companies need to start worrying about health data. Like, does your, like solo entrepreneur or small business need to worry about it or is it only bigger companies? I know some of the some privacy laws, they vary a lot in like I believe it's the CCPA has a pretty high this is a California general data privacy law, has a pretty high revenue threshold. You don't have to worry about it. Or there's other laws like the Family Medical Leave Act that you have to have. I think it's 50 employees. That's my memory. What is it like with health data? Is it the same thing? Do you have to worry if you're a small business? 

00:45
Thora Johnson
I'm so glad you asked that question. So when you're talking about HIPAA, no thresholds, it's just based on your activities. 

00:55
Adam Stofsky
So I'm like a solo therapist down the road or like a solo practitioner. I still need to work. 

01:02
Thora Johnson
Are you billing? Are you billing electronically? That's the question you ask. And if you are, it doesn't matter what your revenue is you're in. Then you think about the state general privacy laws, though CCPA you mentioned they do have thresholds based on revenue and or the number of individuals whose personal information you're processing. But when it comes to the three states now that have consumer health focused laws, there are no thresholds. So you do need to be asking as a small startup whether or not you're subject to them. But a lot will depend, right? Right now, it's Washington, Nevada and Connecticut's are buried in their general consumer privacy law, but they remove the thresholds for health data. So you have to be careful. That's a sneaky. 

01:56
Thora Johnson
Not so you need to ask yourself more as to where you're operating than anything else for the consumer health privacy. 

02:03
Adam Stofsky
Ones, what steps can a startup or a small business or just a business that's never really thought about health data and wants to catch up? What steps can they take to protect themselves in the short term that is. 

02:17
Thora Johnson
Being very transparent in the privacy notice about what health information they're collecting, who they're disclosing it to, and the reasons for the collection. That's the best thing they can do. And then making sure they have adequate consent from the individuals if they are using that information for any service other than the service that the individual has contracted for.