Tag Info

New answers tagged

1

To answer your question according to the points: 1) In a pure sense, no. PHI means identifiable patient information (e.g. a name, an address, a social security number, etc) combined with clinical data (e.g. a diagnosis, CPT code, test result etc). A foreign key in and of itself is not PHI. 2) Not that I am aware of for HIPAA -- HIPAA is more of general ...


0

Disclaimer: I only have a baseline understanding of HIPAA. I would think that as long as the encrypted data is not accessible in an unencrypted form, through the foreign key then it's acceptable. Provided your foreign key is an ID of some sort that's unrelated to the specific PHI the key would not need to be encrypted.


3

Yes, full-disk encryption using AES-256 would be considered HIPAA compliant encryption. It is so because it is a FIPS 140-2 compliant cipher, and data encrypted with FIPS 140-2 cipers is considered "encrypted" under the HIPAA Security Rule. As to whether this qualifies as good enough for "data at rest," that is up to your organization's interpretation of ...


2

PHI means having any piece of identifying information linked with any type of clinical data -- e.g. a diagnosis, CPT code, etc. Therefore, an internal patient identifier on its own is not considered PHI. The release of a simple internal identifier is not a breach, nor is it in violation of any HIPAA regulations I am aware of. Once that identifier can be ...



Top 50 recent answers are included