New answers tagged hipaa
If you're using CloudBerry backup, enable the client-side encryption so that the files are encrypted before they reach Amazon S3. Encrypted Data outside of HIPAA scope You do not need a Business Associate Agreement (BAA) if you are sending encrypted data to a third party provider. Note this encryption must be done with FIPS 140-2 compliant ciphers such as ...
If the action attribute of the form has https://, the data will be encrypted before it is sent to the Hush Secure Forms server. So the issue here is not the encryption. There is however an issue with the fact that the hosting medical site does not use SSL. When an end user views the form, he has no way of knowing whether he is looking at the correct form ...
To answer your question according to the points: 1) In a pure sense, no. PHI means identifiable patient information (e.g. a name, an address, a social security number, etc) combined with clinical data (e.g. a diagnosis, CPT code, test result etc). A foreign key in and of itself is not PHI. 2) Not that I am aware of for HIPAA -- HIPAA is more of general ...
Disclaimer: I only have a baseline understanding of HIPAA. I would think that as long as the encrypted data is not accessible in an unencrypted form, through the foreign key then it's acceptable. Provided your foreign key is an ID of some sort that's unrelated to the specific PHI the key would not need to be encrypted.
Top 50 recent answers are included