If I visit a healthcare information website, like webmd.com, and it's unencrypted, then my service provider knows my name, address, and health attributes. If they kept logs about my visit to those pages, would this be considered PHI under the context of HIPAA? If so, perhaps a lawsuit could force a judge to claim service provider logs are indeed sensitive.
Looking for other's thoughts...