5

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions.

Will using a SSL connection give us the advantage? Also, i believe that the iPhone provides encryption regardless if a phone is protected or not?

Improve this question

2 Answers 2

Reset to default
3

I can't give you the full answer, but the short version that the lawyer at my previous hospital gave me was:

SSL will protect the data that is being transferred, however, anything that is cached to the SD card/Hard Drive is not encrypted...

So, when looking at this application, you will also have to encrypt what is stored on the phone by the app. If you have ever plugged an iPhone into your computer (or a friends), you have access to the full set of storage (including the OS), which means anything cached is available if the phone is lost.

I would look carefully at encrypting at least any PKI, PHI or PII that your program provides to the device.

The problem is that even if the program doesn't store data, the web interface can cache data going to and from the device. This is the part that could cause you problems.

Improve this answer
10
  • Hey, thats the thing. We are not storing any info on the app. the app will pull data from website but will never store anything. after authentication it will display data from database. For our servers, we do use encryption at rest so even if the data is not being shown it is encrypted with 256 bit security.
    – ariel
    May 3, 2012 at 22:38
  • 1
    The problem is that even if the program doesn't store data, the web interface can cache data going to and from the device. This is the part that could cause you problems.
    – powelljf3
    May 4, 2012 at 0:01
  • Hmmm. But if we use SSL connection for data going to and from the device, then its encrypted, thus making it a secure app?
    – ariel
    May 4, 2012 at 0:03
  • SSL is only the transfer, what the app uses on the device is not encrypted just because what is transferred is. If the app uses no cache and you use SSL, you could be safe, the simple fact is that almost all apps cache data prior to transmitting it. Therefore, you would have unencrypted data on your device.
    – powelljf3
    May 4, 2012 at 1:15
  • 1
    Ah, if the patient begins the use, it can be looked at as consent, however, even text data is queued up to be sent, so there is the chance of data on the card. Even posting data would require that the data be encrypted, which could lead to caching, which is back to data on the device. Once again, something you should take up with a lawyer and the person writing the app... There is always a grey area, and a black and white, it is up to those who deal with it on a daily basis to figure out where your program falls.
    – powelljf3
    May 7, 2012 at 3:19
2

The only answer is be fully compliant with HIPAA law and only let individuals who should have permitted use to protected patient data to have access to it in a secure and audited manner. At the very least read, http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

Listing a couple technologies (SSL ; disk-encryption) in use does not make you HIPAA compliant. Make sure you are not unintentionally sharing data with any third parties (e.g., hosting on a cloud platform) that you do not have signed business associate's agreements (BAAs) with. Do not store protected data on unencrypted phones. Make sure your app isn't subject to basic SQL injection/privilege escalation type attacks, monitor user activity for strange behavior, report disclosures, etc.

Improve this answer
1
  • Hey, sorry for the mistake on my part in not clarifying but when i mentioned "other security provisions"; we are doing all above the above like preventing SQL injecitons, networking monitoring, etc. The website is not the problem, its the mobile iphone app that is the issue here.
    – ariel
    May 3, 2012 at 21:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .