I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason information such as
- Phone number
- Email Address
and some other fields will be needed. I am told this all needs to be covered under HIPAA.
I've been doing reading on this for weeks now and I know how to properly encrypt the data in a database which should give her proper HIPAA compliance. In additional I will be building a server for her to store that information on in her office (which I believe also gives her compliance as it's physically separated from everything else and stored in a locked room).
I will never have access to the data and basically once the web site is done I will not have anything to do with it again (barring she wants new features - always the case on these things I suppose).
I read this page here which basically makes it sound like I'm a non-business associate. Am I? Do I need her to sign a form saying that I am? Basically I AM NOT a HIPAA expert, I'm just in this for the money to make a web site which I know how to easily do and don't want to get in some legal trouble later on because of it.