The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.

learn more… | top users | synonyms

24
votes
6answers
7k views

Is it okay for our IT support contractor to remote in without authorization?

We are a healthcare IT company. My machine has PHI on it. Our IT contractor verbally asked if he could remote in to fix my printer so I said sure. I expected some sort of prompt to allow it but he ...
24
votes
8answers
8k views

Can PHI be HIPAA compliant on a cloud?

I have read conflicting information on whether PHI can be stored and delivered on a cloud in a HIPAA compliant manner. I hear many people saying you cannot share infrastructure and be HIPAA compliant. ...
22
votes
4answers
6k views

What are best practices to adhering to HIPAA encryption requirements?

As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance? I've seen varying levels at different ...
17
votes
3answers
2k views

Do HIPAA Security Officers face personal liability for breaches?

The role of HIPAA Security Officer is very important in maintaining compliance. In smaller organizations, there's overlap in employees' roles, so the person that ends up as the HIPAA Security Officer ...
13
votes
4answers
3k views

Is Google Analytics HIPAA compliant? How can I find out?

I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've ...
13
votes
3answers
612 views

What is a reasonable approach for deidentifying data?

I have been asked by a client to deidentify the PHI data in their database and I'm either over-simplifying the process or my client is overly paranoid. Perhaps you can tell me which is the case. ...
11
votes
2answers
4k views

Is encrypted email doctor/patient communication required by HIPAA, HITECH or Meaningful Use

I want to point out, from the start, that I know all about the Direct Project and I am huge fan of work to provide easy-to-use standards based secure email for doctor-patient communication. I am not ...
10
votes
3answers
115 views

What is the term to use when logging an event where a user downloads or prints PHI?

My application logs accesses to PHI. I need to add a log item for things like downloading and printing. Is there a general term that I can use to describe these events? I'm thinking something like "...
9
votes
4answers
335 views

Is having theoretical access to PHI a HIPAA breach, even if no one accesses it?

This is an entirely hypothetical question. Lets say a clinic has a computer in their waiting room for checking email, surfing the web etc. while patients wait. Lets also assume whoever signed this up ...
9
votes
3answers
212 views

Does marketing data trigger HIPAA Privacy?

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that ...
9
votes
1answer
253 views

Is downloading a PDF from a browser-based app locally a HIPAA issue?

Here's a scenario: An intranet CPOE application User runs a report, which downloads as a PDF and opens in Acrobat on the local PC User leaves the PC without logging out or closing Acrobat CPOE ...
9
votes
2answers
957 views

HIPAA compliance without PII

I have a web site where people fill medical syndrome questioners. They can see how their condition changes during the time period. I am not storing ANY PII information, just user name. I can store in ...
8
votes
1answer
91 views

Is Google identity sign in product HIPAA compliant?

I want to use this product to save me a month of coding. Looking for a product that Password expiration forgot password system lock after x times of wrong password Valid passwords rules (min 8 ...
8
votes
1answer
662 views

What solution is compliant with HIPAA for for web-based electronic digital signatures?

I'm interested in having physicians digitally sign pdf documents we create, in a HIPAA-compliant manner. Ideally, there would be an open-source solution, but I'm also willing to consider a digital ...
7
votes
2answers
3k views

Can a Patient's Name, Birth Date, and Study date be sent in a plain text email to a referring doc?

I participate in a mailing list where the following question was asked, without satisfactory feedback, and am interested in the correct answer. Several referring physicians have requested that an ...
7
votes
2answers
834 views

Is accession number+service (CPT code)+date of service considered PHI (protected health information) under HIPAA?

Imagine you are designing a system that's comprised of overdue worklists for doctors (e.g., Doctor X you have 3 overdue studies to look at). In the notification, you identify the studies they have to ...
7
votes
1answer
4k views

Creating a “key server” (HIPAA compliance with AWS)

I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
6
votes
5answers
4k views

Becoming HIPAA Compliant

What is required to become HIPAA Compliant? Do I need to take a test or do I just need to follow a certain set of guidelines? EDIT: Just to provide my background. I am a small IT Firm and we would ...
6
votes
4answers
511 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
6
votes
2answers
112 views

Can a physican website be on a non-HIPAA server?

I'm starting my first website for a doctor's office and I'm wondering if the website needs to be on a HIPAA compliant server, even if no patient health information is collected or stored on the server?...
6
votes
3answers
409 views

Are there guidelines for application design of HIPAA compliant browser applications?

This is a different twist - I'm pushing dispatch information to first responders, such as fire, police, and EMS. But they all could, potentially, include medical information and PII together. My goal ...
6
votes
3answers
2k views

Telemedicine on Google+ Hangouts or Skype. Is it encrypted?

Would one be able to have a telemedicine conversation with a patient with google+ hangouts the way one can over a telephone? In other words does the security satisfy the HIPAA regulations that say ...
6
votes
1answer
396 views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...
5
votes
2answers
1k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
5
votes
3answers
77 views

Is there an explicit standard for protected health info security similar to the one for the Payment Card Industry (PCI)?

See the following for dealing with credit information: https://www.pcisecuritystandards.org/security_standards/ Does a similar standard exist for PHI? Is one being developed?
5
votes
2answers
5k views

How to make an iPhone app HIPAA compliant?

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions. Will using a SSL connection give us the ...
5
votes
3answers
643 views

HIPAA compliance in web forums?

If a website has a private forum (membership is not free) where people may ask health questions and paid Doctors are around to answer them, do normal HIPAA compliance rules apply? In any forum, ...
5
votes
3answers
707 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
5
votes
3answers
2k views

MS-SQL Monitoring/Auditing of PHI for HIPAA

We're currently looking for a solution (hardware or software-based) that can monitor and audit all PHI viewing activity per new HIPAA rules. We use MS-SQL for our production database. We have the ...
4
votes
2answers
2k views

Does there exist software that will scan a filesystem for possible files containing PHI?

I don't need a list of software (I know shopping questions are off topic), but my google-fu is failing me at this. Basically looking for software that will scan a filesystem looking for files that may ...
4
votes
1answer
992 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
4
votes
0answers
65 views

HIPAA/FISMA certification for IT audits [closed]

I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
3
votes
2answers
111 views

Any advice on how to assure patients that a medical facility is well protected against identity theft?

My apologies if this question has been asked before. How does a medical practice assure patients that the practice follows excellent computer security practices? Conversely, how does a patient find ...
3
votes
3answers
887 views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
3
votes
1answer
194 views

What documentation can I ask a vendor for to show HIPAA compliance

Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit ...
3
votes
2answers
207 views

Are AWS security groups sufficient to authenticate communication between instances? (HIPAA)

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service. Is it enough to partition these services ...
2
votes
2answers
633 views

Can you protect corporate email on personal phones without the option of wiping all personal data?

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ...
2
votes
1answer
87 views

Avoiding HIPAA, part 2

I'm building a new website, that may be subject to HIPAA. But I won't normally need access to the data. If I encrypt, or somehow encode, the personally identifiable parts, so only the user can decrypt ...
2
votes
1answer
406 views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
2
votes
1answer
1k views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
2
votes
1answer
288 views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...
2
votes
1answer
477 views

Securing Isolated AWS Deployments to comply with HIPAA/HITECH

HIPAA Security Hounds...How would you view an AWS deployment that included a set of systems deployed together at AWS (within a single, secured Virtual Private Cloud), using a key to encrypt all ...
2
votes
1answer
863 views

How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?

Objective: HIPAA compliance. Here is the process: Receive PDF File through secure website Open the PDF (Which involves downloading to some folder) No longer need PDF The Question: Is there any ...
2
votes
1answer
129 views

Hushmails “Secure Forms” & HIPAA

I just picked up a job for integrating Hushmail's Secure Web Forms into a medical website. The forms will submit patient's (PHI) data to Hushmail's servers, encrypt the data, and then send it to their ...
2
votes
2answers
75 views

Are foreign keys linking to a table with PHI considered PHI under HIPAA?

Table 1 has PHI and it's encrypted. Table 2 doesn't have PHI, isn't encrypted and has a foreign key to Table 1. I'd like to recommend the strongest security. If there's a requirement in HIPAA, it's ...
2
votes
1answer
283 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
2
votes
1answer
714 views

Multi Tenant Database - HIPAA

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) ...
2
votes
1answer
92 views

Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups

Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete ...
2
votes
1answer
101 views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
2
votes
0answers
83 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...