Clients have often as asked whether HIPAA applies to the cannabis industry. As with anything else in healthcare, the answer can be complex. HIPAA was enacted in 1996 to help protect a patient’s healthcare information. While HIPAA is expansive, to the extent state law is more restrictive or protective, then state law will control in those instances. 45 CFR § 160.201 et. seq. But the first question is whether HIPAA applies to the cannabis industry.
Are Cannabis Dispensaries Covered Entities?
For information to be protected under HIPAA, there are several aspects to analyze. Boiled down to its basics, HIPAA will apply when a “Covered Entity” has “Protected Health Information”. As with any other statutory regime, the first place to start with the analysis are the definitions. A “covered entity” includes a health plan (e.g., a third-party payor), a health care clearinghouse (e.g., a third-party system that interprets claims data between healthcare provider systems and third-party payers), and a health care provider. 45 CFR § 160.103. So, is a dispensary a “health care provider”? For adult use or recreational dispensaries, the answer is no. However, for medical marijuana dispensaries, a deeper dive into the HIPAA regulations is essential.
A health care