The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.
0
votes
0answers
7 views
Has anyone used 3rd party hosting solutions that are HIPAA compliant?
We have some PHI information as videos that must be hosted and streamed to meet HIPAA standards.
Has anyone been able to use a 3rd party hosting solution like Brightcove or Ooyala while meeting HIPAA ...
2
votes
2answers
110 views
Does there exist software that will scan a filesystem for possible files containing PHI?
I don't need a list of software (I know shopping questions are off topic), but my google-fu is failing me at this. Basically looking for software that will scan a filesystem looking for files that may ...
2
votes
1answer
130 views
Securing Isolated AWS Deployments to comply with HIPAA/HITECH
HIPAA Security Hounds...How would you view an AWS deployment that included a set of systems deployed together at AWS (within a single, secured Virtual Private Cloud), using a key to encrypt all ...
1
vote
1answer
51 views
Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups
Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete ...
4
votes
3answers
165 views
Are there guidelines for application design of HIPAA compliant browser applications?
This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together.
My goal ...
1
vote
3answers
182 views
Keyless entry security systems and HIPAA implications
We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
4
votes
3answers
173 views
Are there a standard method(s) for me to give someone else read-only access to my data?
Are there a standard method(s) for me to give someone else read-only access to my data?
There are several situations where I may want to give a few people read-only access to some data, but I would ...
2
votes
1answer
200 views
How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?
Objective: HIPAA compliance.
Here is the process:
Receive PDF File through secure website
Open the PDF (Which involves downloading to some folder)
No longer need PDF
The Question:
Is there any ...
3
votes
2answers
2k views
How to make an iPhone app HIPAA compliant?
How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions.
Will using a SSL connection give us the ...
9
votes
2answers
981 views
Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use
I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
7
votes
1answer
93 views
Is downloading a PDF from a browser-based app locally a HIPAA issue?
Here's a scenario:
An intranet CPOE application
User runs a report, which downloads as a PDF and opens in Acrobat on the local PC
User leaves the PC without logging out or closing Acrobat
CPOE ...
5
votes
2answers
682 views
Can a Patient's Name, Birth Date, and Study date be sent in a plain text email to a referring doc?
I participate in a mailing list where the following question was asked, without satisfactory feedback, and am interested in the correct answer.
Several referring physicians have requested that an ...
16
votes
7answers
4k views
Can PHI be HIPAA compliant on a cloud?
I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant.
...
7
votes
1answer
214 views
What solution is compliant with HIPAA for for web-based electronic digital signatures?
I'm interested in having physicians digitally sign pdf documents we create, in a HIPAA-compliant manner. Ideally, there would be an open-source solution, but I'm also willing to consider a digital ...
6
votes
2answers
138 views
Is accession number+service (CPT code)+date of service considered PHI (protected health information) under HIPAA?
Imagine you are designing a system that's comprised of overdue worklists for doctors (e.g., Doctor X you have 3 overdue studies to look at). In the notification, you identify the studies they have to ...
7
votes
3answers
61 views
What is the term to use when logging an event where a user downloads or prints PHI?
My application logs accesses to PHI. I need to add a log item for things like downloading and printing.
Is there a general term that I can use to describe these events? I'm thinking something like ...
7
votes
3answers
48 views
Does marketing data trigger HIPAA Privacy?
If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
7
votes
2answers
337 views
HIPAA compliance without PII
I have a web site where people fill medical syndrome questioners.
They can see how their condition changes during the time period.
I am not storing ANY PII information, just user name.
I can store in ...
11
votes
3answers
85 views
What is a reasonable approach for deidentifying data?
I have been asked by a client to deidentify the PHI data in their database and I'm either over-simplifying the process or my client is overly paranoid. Perhaps you can tell me which is the case.
...
9
votes
4answers
599 views
Is Google Analytics HIPAA compliant? How can I find out?
I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
6
votes
4answers
90 views
Is having theoretical access to PHI a HIPAA breach, even if no one accesses it?
This is an entirely hypothetical question.
Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up ...
4
votes
3answers
37 views
Is there an explicit standard for protected health info security similar to the one for the Payment Card Industry (PCI)?
See the following for dealing with credit information:
https://www.pcisecuritystandards.org/security_standards/
Does a similar standard exist for PHI? Is one being developed?
15
votes
3answers
590 views
Do HIPAA Security Officers face personal liability for breaches?
The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
18
votes
3answers
1k views
What are best practices to adhering to HIPAA encryption requirements?
As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance?
I've seen varying levels at different ...
3
votes
3answers
215 views
HIPAA compliance in web forums?
If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply?
In any forum, ...
