My medical chat application is handling PHI, and it enforcing unique, secure logins which ensure that only authorized / appropriate people can access that data. For now, I implemented touchID Authentication with iOS. By this feature, device owner can sign in to last logged-in user's account with touchID.

Under HIPAA, is it allowable to remember/store user credentials in web/mobile/desktop applications?

  • 1
    does hipaa even apply to an app's credentials? – schroeder Jul 26 '17 at 14:44
  • not a lawyer here, but I did get trained in HIPAA. I'm 99% sure that, yes that's fine, and furthermore that touchID is pretty good too, so you don't have to worry you're letting user down or placing them at risk. – dandavis Jul 27 '17 at 4:04
  • @dandavis : Suppose , a user temporarily login with other's device for some emergency purpose and logged-out from his account. In this case, the device owner can able to login to his account just by touchID, without knowing his credentials. What about this? – prinz Jul 28 '17 at 10:12

The security rule of HIPAA doesn't specifically address this. However, if you can prove that touchID requires actual validation of whomever is authorized for the ePHI for access-- then it suffices. However, you could be dinged on the implementation configuration for system security safeguards so you'll need to have documentation and compensating controls if required for any weaknesses related to touchID and specifically how your mobile device is managed. You may also want to validate with the vendor if a risk assessment has been performed for other customers for HIPAA environments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.