Skip to main content

Questions tagged [hipaa]

The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.

Filter by
Sorted by
Tagged with
0 votes
0 answers
115 views

Proper HIPAA security

I am a sysadmin, though not security-specific. I was recently stunned to receive an automated email from my physician's office (in USA) containing an HTTP link to their website for the completion of ...
Charles Nix's user avatar
0 votes
1 answer
281 views

HIPAA Compliance for Frontend Hosting

I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database ...
Infamous911's user avatar
1 vote
1 answer
402 views

How to secure data on production environment

Question Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
VB_'s user avatar
  • 225
1 vote
0 answers
98 views

Out of Domain Requests for HIPAA Complaint Apps

I have a HIPAA complaint app which uses an API hosted at https://iswearthisissecure.com. Is the app allowed to make outbound requests to services that are not HIPAA compliant if no PHI is transferred? ...
fny's user avatar
  • 203
3 votes
2 answers
1k views

Is it safe to keep decrypted data in memory?

Due to new laws in my country, any personal information must to be stored encrypted in the database. So, to be able to perform querys over this data I was thinking to keep an in-memory copy of these ...
Beetlejuice's user avatar
3 votes
2 answers
1k views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
Ajeesh Joshy's user avatar
1 vote
1 answer
160 views

Need of Encryption for storing Health Information

I am managing development of a platform for health service providers and thus, it houses health information about patients registered. The patient register themselves on the system and maintain their ...
Umair Ahmed's user avatar
0 votes
1 answer
151 views

Is sending an Email without any PHI violates HIPAA privacy rule?

I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
Ajeesh Joshy's user avatar
1 vote
0 answers
127 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
faustus's user avatar
  • 111
0 votes
0 answers
97 views

Maintaining HIPAA compliance with company dividing into two parts

I am a consultant and I have a client who is planning on dividing into two different companies. Let's call the company "A" where no Hipaa will be required and "B" for which it will be required. ...
LUser's user avatar
  • 846
0 votes
1 answer
396 views

What is the point of HIPAA de-identification + re-identification?

Section 164.514(c) of the HIPAA of Privacy rules discusses re-identification of PHI. If a covered entity or business associate successfully undertook an effort to identify the subject of de-...
Paul Draper's user avatar
  • 1,010
1 vote
1 answer
188 views

Is there such a thing as a "non-business associate contract" for HIPAA related work [closed]

I'm creating a website that is HIPAA related for contract work and want to make sure I dot all my i's. I keep seeing Business Associate contracts on the internet, but so far I have not seen anything ...
Element Zero's user avatar
1 vote
1 answer
266 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
Taxes45's user avatar
  • 113
1 vote
0 answers
153 views

HIPAA compliant BI reporting tool?

We are building an application for healthcare industry and we are planning to use a 3rd party BI tool for reporting which will directly connect to our postgres DB and generate the desired reports ...
user3170450's user avatar
0 votes
1 answer
148 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
Element Zero's user avatar
1 vote
1 answer
200 views

How does TrueVault's de-identification process work?

I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
HSuman's user avatar
  • 33
2 votes
0 answers
231 views

May have breached hipaa by accident

I'm new as a software dev and I was assigned to implement some changes to an application. When I asked my colleague I was told it didn't exist a test version and said it had to be uploaded to the real ...
Kndler's user avatar
  • 21
2 votes
0 answers
562 views

HIPAA compliant chat app with 3rd party provider without signing a BAA?

Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant? Long: To be specific, I was ...
Murat Ozgul's user avatar
0 votes
1 answer
802 views

Can I say that my web app is HIPAA compliant?

My team and I created a web app that transfers data from a VOIP system (recorded calls, voicemails, faxes, texts) to cloud storage (Google Drive, Amazon S3, Box.com). In and of itself, our app follows ...
Matt Spinks's user avatar
1 vote
1 answer
2k views

For HIPAA, Does US Patient Data Have To Stay On US Servers? [closed]

For an application that stores US patient data, does HIPAA require that US data stays on US servers?
Ben Rei's user avatar
  • 19
1 vote
2 answers
160 views

Developers VS HIPAA

I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
LUser's user avatar
  • 846
0 votes
2 answers
536 views

Would it be HIPAA compliant to share docs with EHR data between two HIPAA compliant Gsuite organizations

Assuming both organizations have HIPAA compliant G-Suite and have signed the necessary legal documents. My gut says this should not be a problem as its done within the google servers, am I missing ...
novirt's user avatar
  • 3
4 votes
2 answers
212 views

Can an HTML-based patient report be HIPAA-compiliant?

Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics. My application receives no identifying information about the patient. It ...
RobertAKARobin's user avatar
0 votes
1 answer
1k views

NewMFA Requirement For HIPAA?

I was told by a vendor that there's new guidance effective in 2017 that mandates Multi-Factor Authentication for all systems that host PHI. They said that things like white-listing IP addresses was ...
the_joey_o's user avatar
1 vote
1 answer
378 views

Under HIPAA, is it allowable to remember/store user credentials?

My medical chat application is handling PHI, and it enforcing unique, secure logins which ensure that only authorized / appropriate people can access that data. For now, I implemented touchID ...
prinz's user avatar
  • 111
2 votes
1 answer
636 views

Best way to secure a cross-platform mobile app for HIPAA compliance

I'm developing a cross-platform, offline first mHealth application using Ionic 3 and Cordova which may need to be HIPAA compliant in the near future. It uses PouchDB as a client-side DB, HTTPS, at-...
juliet's user avatar
  • 23
1 vote
1 answer
152 views

Application used in health industry: HIPAA HITECH hosting "requirements"

We have a scenario at my employer where we host an application that is used for uploading, storing, & managing documents related to patients' bills from healthcare providers. It is our knowledge ...
maloitpro's user avatar
1 vote
0 answers
128 views

certification to get in order to save PHI for European businesses

I work in a digital health company that will likely save personal Health information. I am conflicting what certification I best get in order to best meet the needs of business partners from Europe. ...
WebQube's user avatar
  • 129
1 vote
0 answers
205 views

What is EU-US security shield certificate means in term of EU PHI compliance

I'm facing a regulation issue. My servers are hosted on Google Cloud. I see that Google is HIPAA and Privacy Shield approved. If my database servers are hosted with Google and I'm storing personal ...
WebQube's user avatar
  • 129
0 votes
3 answers
488 views

How to achieve other security compliances/certifications on AWS after satisfying HIPAA? [closed]

Our infrastructure is built entirely on AWS and we went through the HIPAA process to ensure that our system is HIPAA-compliant. Where should we look or what next steps can we take to obtain other ...
Paul Lam's user avatar
  • 101
1 vote
0 answers
120 views

Is sending an audio file with a portion of an accession number a violation of HIPAA

Assuming a hypothetical scenario: The hospital radiology dictation system is down. The transcriptionist works off-site. The radiologist has the ability to record an audio file on his phone or laptop ...
Jack's user avatar
  • 11
0 votes
1 answer
183 views

HIPAA compliance: how much does it matter? [closed]

I'm working with an android app sending data to a service hosted on AWS. The provider specifies that AWS in itself isn't HIPAA compliant. In which way should this by a source of worry? Regardless of ...
Francky_V's user avatar
  • 103
1 vote
0 answers
156 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
bluefalcon's user avatar
1 vote
2 answers
197 views

AWS HIPAA requires hardware dedicated to a single customer

Amazon HIPAA compliance requires customers to run on dedicated hardware (https://aws.amazon.com/compliance/hipaa-compliance/). I would think isolation of the operating system and encryption of data ...
henry's user avatar
  • 13
1 vote
1 answer
6k views

Can I send a Medical Record Number (MRN) via email internally? [closed]

We use Office 365, which might make a difference. Can I (legally) send an MRN, with no other demographic or health information, from [email protected] to [email protected]?
user avatar
1 vote
1 answer
1k views

Crosswalks (aka Matrix) for InfoSec Compliance Standards

Looking to find a reference that maps the various control standards (i.e. HIPAA, PCI-DSS, GLBA, ISO) to each other. I envision the answer being a spreadsheet that outlines the controls for one ...
HashHazard's user avatar
  • 5,185
0 votes
4 answers
183 views

Is it okay to store this health data in a public cloud? [closed]

Is it okay to store relative health data in the public cloud, accessible by all users of my mobile app? Put another way, is this not considered PHI? For example: Bob has a resting heart rate of 40 ...
tktsubota's user avatar
  • 103
2 votes
1 answer
433 views

Shared floor space, cameras and HIPAA compliance

I am a compliance associate at my company, which is a small call center. My problem is that two of our clients will have to share floor space. One client is tech support for high-end action cameras, ...
Dadfia's user avatar
  • 23
25 votes
6 answers
10k views

Is it okay for our IT support contractor to remote in to my workstation without authorization from me?

We are a healthcare IT company. My machine has Protected health information on it. Our IT contractor verbally asked if he could remote in to fix my printer so I said sure. I expected some sort of ...
user avatar
1 vote
0 answers
84 views

HIPAA Related question regarding Prescription Rx Reports [closed]

This is a close approximation of my in-person conversation at the Local CVS: Me: Hi, I'd like to get the 2015 Medication Report for myself and my wife. Clerk: I can print yours, if you have Photo ID,...
Fred Deutsch's user avatar
2 votes
1 answer
1k views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
bkr's user avatar
  • 163
5 votes
2 answers
3k views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
icehenge's user avatar
  • 430
7 votes
1 answer
420 views

Is Google identity sign in product HIPAA compliant?

I want to use this product to save me a month of coding. Looking for a product that Password expiration forgot password system lock after x times of wrong password Valid passwords rules (min 8 ...
Ohad Perry's user avatar
1 vote
0 answers
80 views

Is a business associates contract required to use hosted R&D services? [closed]

I'm on the "configuration management" team which, among other things, means I'm responsible for R&D systems, like: source control, issue tracking, team collaboration (wiki), etc. These are not ...
Anthony Mastrean's user avatar
2 votes
0 answers
181 views

HIPAA/FISMA certification for IT audits [closed]

I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
POSH Geek's user avatar
  • 320
2 votes
0 answers
174 views

Does our support chat need to be HIPAA compliant? [closed]

We are currently using olark to provide an instant chat support feature to our customers. Customer typically ask about outages, setup issues, etc. We are in the process of trying to become HIPAA ...
RandomDeduction's user avatar
3 votes
3 answers
11k views

Can name, DOB and ID be PHI?

Can a person's name, date of birth and proprietary ID be considered as PHI? Ex: Joe Doe, 11/25/1955, 45698745236.
mxarun's user avatar
  • 31
2 votes
1 answer
211 views

Avoiding HIPAA, part 2

I'm building a new website, that may be subject to HIPAA. But I won't normally need access to the data. If I encrypt, or somehow encode, the personally identifiable parts, so only the user can decrypt ...
Dan's user avatar
  • 55
1 vote
2 answers
609 views

Avoiding HIPAA, will this work?

I'm building a new website, and I'm trying to figure out if I need to worry about HIPAA. And if I do, I'm trying to figure out a way I can stop worrying about HIPAA. An example of something kinda ...
Dan's user avatar
  • 55
0 votes
1 answer
217 views

"If encryption has not been implemented, a comparable alternative has been implemented" [closed]

What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption. If the context is authorized access ...
Jason's user avatar
  • 3,126