The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.

learn more… | top users | synonyms

3
votes
2answers
66 views

Any advice on how to assure patients that a medical facility is well protected against identity theft?

My apologies if this question has been asked before. How does a medical practice assure patients that the practice follows excellent computer security practices? Conversely, how does a patient find ...
0
votes
0answers
54 views

HIPAA requirements for local server

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement. Most computers will most likely have no ...
3
votes
2answers
101 views

Are AWS security groups sufficient to authenticate communication between instances? (HIPAA)

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service. Is it enough to partition these services ...
0
votes
1answer
74 views

Gmail Voicemail Encryption

I want to listen to my voicemails in a secure but convenient fashion. I plan do this by having my PBX encrypt the voicemail using openssl aes 256 cbc with salt and a single static password. The ...
0
votes
1answer
154 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...
2
votes
1answer
271 views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
1
vote
1answer
66 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
2
votes
1answer
174 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
1
vote
1answer
186 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
1
vote
0answers
97 views

HIPAA Compliant App, using Encypted Core Data vs Core Data Attribute Encyption

I am writing an iOS app which needs to be HIPAA compliant. The app should preferably function offline, so data needs to be stored on the phone. So here is what I was thinking of doing: On First ...
0
votes
1answer
231 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
0
votes
2answers
117 views

Determining if company is considered a business associate under HIPAA?

I am trying to clearly understand the HIPAA regulations a court reporting company must adhere to. Let's say the court reporting company does not directly contract with any covered entities but does ...
5
votes
2answers
98 views

Can a physican website be on a non-HIPAA server?

I'm starting my first website for a doctor's office and I'm wondering if the website needs to be on a HIPAA compliant server, even if no patient health information is collected or stored on the ...
1
vote
1answer
39 views

Is disaster recovery a requirement for any and every application that uses any ePHI?

HIPAA requirements seem to state that a disaster recovery plan is a required implementation, defined within the HIPAA Contingency Plan standard in the Administrative Safeguards section of the HIPAA ...
0
votes
1answer
495 views

Can someone please briefly explain HIPPA compliance?

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows: Client ...
4
votes
1answer
553 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
6
votes
3answers
1k views

Telemedicine on Google+ Hangouts or Skype. Is it encrypted?

Would one be able to have a telemedicine conversation with a patient with google+ hangouts the way one can over a telephone? In other words does the security satisfy the HIPAA regulations that say ...
4
votes
3answers
898 views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
0
votes
1answer
95 views

Is this HIPAA-protected health information?

We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other ...
4
votes
4answers
3k views

Becoming HIPAA Compliant

What is required to become HIPAA Compliant? Do I need to take a test or do I just need to follow a certain set of guidelines? EDIT: Just to provide my background. I am a small IT Firm and we would ...
2
votes
2answers
298 views

Can you protect corporate email on personal phones without the option of wiping all personal data?

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ...
3
votes
2answers
697 views

Does there exist software that will scan a filesystem for possible files containing PHI?

I don't need a list of software (I know shopping questions are off topic), but my google-fu is failing me at this. Basically looking for software that will scan a filesystem looking for files that may ...
2
votes
1answer
357 views

Securing Isolated AWS Deployments to comply with HIPAA/HITECH

HIPAA Security Hounds...How would you view an AWS deployment that included a set of systems deployed together at AWS (within a single, secured Virtual Private Cloud), using a key to encrypt all ...
1
vote
1answer
75 views

Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups

Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete ...
5
votes
3answers
284 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
0
votes
3answers
288 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
6
votes
4answers
387 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
2
votes
1answer
520 views

How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?

Objective: HIPAA compliance. Here is the process: Receive PDF File through secure website Open the PDF (Which involves downloading to some folder) No longer need PDF The Question: Is there any ...
5
votes
2answers
3k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
10
votes
2answers
3k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
9
votes
1answer
177 views

Is downloading a PDF from a browser-based app locally a HIPAA issue?

Here's a scenario: An intranet CPOE application User runs a report, which downloads as a PDF and opens in Acrobat on the local PC User leaves the PC without logging out or closing Acrobat CPOE ...
6
votes
2answers
2k views

Can a Patient's Name, Birth Date, and Study date be sent in a plain text email to a referring doc?

I participate in a mailing list where the following question was asked, without satisfactory feedback, and am interested in the correct answer. Several referring physicians have requested that an ...
20
votes
7answers
6k views

Can PHI be HIPAA compliant on a cloud?

I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant. ...
8
votes
1answer
462 views

What solution is compliant with HIPAA for for web-based electronic digital signatures?

I'm interested in having physicians digitally sign pdf documents we create, in a HIPAA-compliant manner. Ideally, there would be an open-source solution, but I'm also willing to consider a digital ...
7
votes
2answers
447 views

Is accession number+service (CPT code)+date of service considered PHI (protected health information) under HIPAA?

Imagine you are designing a system that's comprised of overdue worklists for doctors (e.g., Doctor X you have 3 overdue studies to look at). In the notification, you identify the studies they have to ...
9
votes
3answers
97 views

What is the term to use when logging an event where a user downloads or prints PHI?

My application logs accesses to PHI. I need to add a log item for things like downloading and printing. Is there a general term that I can use to describe these events? I'm thinking something like ...
8
votes
3answers
116 views

Does marketing data trigger HIPAA Privacy?

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
6
votes
1answer
3k views

Creating a “key server” (HIPAA compliance with AWS)

I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
8
votes
2answers
593 views

HIPAA compliance without PII

I have a web site where people fill medical syndrome questioners. They can see how their condition changes during the time period. I am not storing ANY PII information, just user name. I can store in ...
13
votes
3answers
225 views

What is a reasonable approach for deidentifying data?

I have been asked by a client to deidentify the PHI data in their database and I'm either over-simplifying the process or my client is overly paranoid. Perhaps you can tell me which is the case. ...
11
votes
4answers
2k views

Is Google Analytics HIPAA compliant? How can I find out?

I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
9
votes
4answers
240 views

Is having theoretical access to PHI a HIPAA breach, even if no one accesses it?

This is an entirely hypothetical question. Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up ...
5
votes
3answers
65 views

Is there an explicit standard for protected health info security similar to the one for the Payment Card Industry (PCI)?

See the following for dealing with credit information: https://www.pcisecuritystandards.org/security_standards/ Does a similar standard exist for PHI? Is one being developed?
16
votes
3answers
2k views

Do HIPAA Security Officers face personal liability for breaches?

The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
19
votes
4answers
3k views

What are best practices to adhering to HIPAA encryption requirements?

As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance? I've seen varying levels at different ...
4
votes
3answers
394 views

HIPAA compliance in web forums?

If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply? In any forum, ...