The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.

learn more… | top users | synonyms

0
votes
3answers
361 views

Keyless entry security systems and HIPAA implications

We are upgrading our office to have badged security doors. What I would particularly like to know is if Keyless Entry systems exist or are of decent quality. By this I mean, I would like the doors ...
6
votes
4answers
510 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
2
votes
1answer
851 views

How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?

Objective: HIPAA compliance. Here is the process: Receive PDF File through secure website Open the PDF (Which involves downloading to some folder) No longer need PDF The Question: Is there any ...
5
votes
2answers
5k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
11
votes
2answers
4k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
9
votes
1answer
251 views

Is downloading a PDF from a browser-based app locally a HIPAA issue?

Here's a scenario: An intranet CPOE application User runs a report, which downloads as a PDF and opens in Acrobat on the local PC User leaves the PC without logging out or closing Acrobat CPOE ...
7
votes
2answers
3k views

Can a Patient's Name, Birth Date, and Study date be sent in a plain text email to a referring doc?

I participate in a mailing list where the following question was asked, without satisfactory feedback, and am interested in the correct answer. Several referring physicians have requested that an ...
24
votes
8answers
8k views

Can PHI be HIPAA compliant on a cloud?

I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant. ...
8
votes
1answer
648 views

What solution is compliant with HIPAA for for web-based electronic digital signatures?

I'm interested in having physicians digitally sign pdf documents we create, in a HIPAA-compliant manner. Ideally, there would be an open-source solution, but I'm also willing to consider a digital ...
7
votes
2answers
819 views

Is accession number+service (CPT code)+date of service considered PHI (protected health information) under HIPAA?

Imagine you are designing a system that's comprised of overdue worklists for doctors (e.g., Doctor X you have 3 overdue studies to look at). In the notification, you identify the studies they have to ...
10
votes
3answers
115 views

What is the term to use when logging an event where a user downloads or prints PHI?

My application logs accesses to PHI. I need to add a log item for things like downloading and printing. Is there a general term that I can use to describe these events? I'm thinking something like ...
9
votes
3answers
210 views

Does marketing data trigger HIPAA Privacy?

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
7
votes
1answer
4k views

Creating a “key server” (HIPAA compliance with AWS)

I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
9
votes
2answers
944 views

HIPAA compliance without PII

I have a web site where people fill medical syndrome questioners. They can see how their condition changes during the time period. I am not storing ANY PII information, just user name. I can store in ...
13
votes
3answers
595 views

What is a reasonable approach for deidentifying data?

I have been asked by a client to deidentify the PHI data in their database and I'm either over-simplifying the process or my client is overly paranoid. Perhaps you can tell me which is the case. ...
13
votes
4answers
3k views

Is Google Analytics HIPAA compliant? How can I find out?

I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
9
votes
4answers
334 views

Is having theoretical access to PHI a HIPAA breach, even if no one accesses it?

This is an entirely hypothetical question. Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up ...
5
votes
3answers
76 views

Is there an explicit standard for protected health info security similar to the one for the Payment Card Industry (PCI)?

See the following for dealing with credit information: https://www.pcisecuritystandards.org/security_standards/ Does a similar standard exist for PHI? Is one being developed?
17
votes
3answers
2k views

Do HIPAA Security Officers face personal liability for breaches?

The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
22
votes
4answers
6k views

What are best practices to adhering to HIPAA encryption requirements?

As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance? I've seen varying levels at different ...
5
votes
3answers
627 views

HIPAA compliance in web forums?

If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply? In any forum, ...