New answers tagged hipaa
The MRN (or patient id) itself in the URL is not a problem. athenahealth's REST-based APIs take patient ids directly in the URLs, and I'm guessing they have better lawyers than you do. The problem is if the URL itself, or use of your service in general would allow someone to imply something about the patient. For example, if you have URLs like ...
Top 50 recent answers are included