I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason information such as

  • Name
  • Phone number
  • Address
  • Email Address

and some other fields will be needed. I am told this all needs to be covered under HIPAA.

I've been doing reading on this for weeks now and I know how to properly encrypt the data in a database which should give her proper HIPAA compliance. In additional I will be building a server for her to store that information on in her office (which I believe also gives her compliance as it's physically separated from everything else and stored in a locked room).

I will never have access to the data and basically once the web site is done I will not have anything to do with it again (barring she wants new features - always the case on these things I suppose).

I read this page here which basically makes it sound like I'm a non-business associate. Am I? Do I need her to sign a form saying that I am? Basically I AM NOT a HIPAA expert, I'm just in this for the money to make a web site which I know how to easily do and don't want to get in some legal trouble later on because of it.

1 Answer 1


Yes, that is correct.

Based on your agreement, if you are building anything that touches (stores,transmits, or manipulates) PHI (Protected Health Information), you must meet HIPAA security rules (164.312 Technical safeguards) by the book.

It covers only covered entities and BA-s but as a non BA vendor you are responsible to meet or exceed the standards and to show due diligence, being a non BA vendor liability is not shifted, you can and should have and EO or other professional insurance to mitigate risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .