Do CPAP SD cards have personally identifiable information?

Would the information from CPAP machine SD cards be subject to HIPAA if the information was being transferred over the internet through some software program? Or do CPAP SD cards not store any personally identifiable information, so they wouldn't be subject to HIPAA regulations?

slprrrr wrote:Would the information from CPAP machine SD cards be subject to HIPAA if the information was being transferred over the internet through some software program? Or do CPAP SD cards not store any personally identifiable information, so they wouldn't be subject to HIPAA regulations?

the only identifying thing is the serial number of the cpap.

slprrrr wrote:Would the information from CPAP machine SD cards be subject to HIPAA if the information was being transferred over the internet through some software program? Or do CPAP SD cards not store any personally identifiable information, so they wouldn't be subject to HIPAA regulations?

I suspect HIPAA is more complicated than that.

However, in general, the SD card has information about the airflow and pressure at the output of your CPAP machine. It has information about these measurements over time. It has details about the machine settings such as pressure, ramp, exhale relief, ramp, humidifier, and heated hose settings. It records when you turned the machine on and off and made changes in settings.

It has information about your CPAP model and serial number, which could be linked to your identity by the DME, your doctor, insurance company, or someone else with access to your other medical records.

I've never seen any machines that store information like names on the SD card.

I believe if you sign up for ResMed's online service on their website that any information you provide *may* be subject to HIPPA. And your DME is subject to HIPPA whenever they download information from your card. But nothing identifiable can be gleaned solely from the card.

slprrrr wrote:Would the information from CPAP machine SD cards be subject to HIPAA if the information was being transferred over the internet through some software program? Or do CPAP SD cards not store any personally identifiable information, so they wouldn't be subject to HIPAA regulations?

Speaking only for Respironics machines:

If the prescription for your machine is set using Encore Pro, then it may be that personally identifying information might be recorded on the card since it is all in the Encore database. I have experimented with setting prescription parameters that way but have not tried to take apart the SD prescription record to see what else is stored there.

If Encore is not used, then its not likely that personal information is stored on the card.

So, unless someone knows the particulars, the best answer is maybe.

Very interesting question, though. I look forward to a definitive answer.