Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hipaa]

The US-american "Health Insurance Portability and Accountability Act" of 1996 (HIPAA) is Public Law 104-191, which was enacted on August 21, 1996.

0
votes
0answers
21 views

HIPAA : Writing Policies and Process For Workstation Surroundings

I am writing policies that the company will follow and I am going through the HIPAA compliance check list as a guide. I am trying to make sense of this item though. To me a lot of these seem vague and ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
0
votes
0answers
30 views

Maintaining HIPAA compliance with company dividing into two parts

I am a consultant and I have a client who is planning on dividing into two different companies. Let's call the company "A" where no Hipaa will be required and "B" for which it will be required. ...
0
votes
1answer
67 views

What is the point of HIPAA de-identification + re-identification?

Section 164.514(c) of the HIPAA of Privacy rules discusses re-identification of PHI. If a covered entity or business associate successfully undertook an effort to identify the subject of de-...
1
vote
1answer
66 views

Is there such a thing as a “non-business associate contract” for HIPAA related work [closed]

I'm creating a website that is HIPAA related for contract work and want to make sure I dot all my i's. I keep seeing Business Associate contracts on the internet, but so far I have not seen anything ...
1
vote
1answer
173 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
1
vote
0answers
44 views

HIPAA compliant BI reporting tool?

We are building an application for healthcare industry and we are planning to use a 3rd party BI tool for reporting which will directly connect to our postgres DB and generate the desired reports ...
0
votes
1answer
49 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
0
votes
1answer
70 views

How does TrueVault's de-identification process work?

I'm thinking of using TrueVault, but I'm not entirely sure about the sequence of events involved in de-identifying data and re-identifying it. More info here. Here is the process, as I understand it, ...
0
votes
0answers
103 views

Reference PHI data with a none HIPAA compliance storage

We store PHI data in AWS DynamoDB, we store connected non PHI in AWS Neptune. We will reference this through a user id, this will generated at user creation, the id is time based hash. Is this a ...
2
votes
0answers
167 views

May have breached hipaa by accident

I'm new as a software dev and I was assigned to implement some changes to an application. When I asked my colleague I was told it didn't exist a test version and said it had to be uploaded to the real ...
2
votes
0answers
218 views

HIPAA compliant chat app with 3rd party provider without signing a BAA?

Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant? Long: To be specific, I was ...
0
votes
1answer
319 views

Can I say that my web app is HIPAA compliant?

My team and I created a web app that transfers data from a VOIP system (recorded calls, voicemails, faxes, texts) to cloud storage (Google Drive, Amazon S3, Box.com). In and of itself, our app follows ...
1
vote
1answer
365 views

For HIPAA, Does US Patient Data Have To Stay On US Servers? [closed]

For an application that stores US patient data, does HIPAA require that US data stays on US servers?
1
vote
2answers
77 views

Developers VS HIPAA

I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's ...
0
votes
2answers
307 views

Would it be HIPAA compliant to share docs with EHR data between two HIPAA compliant Gsuite organizations

Assuming both organizations have HIPAA compliant G-Suite and have signed the necessary legal documents. My gut says this should not be a problem as its done within the google servers, am I missing ...
4
votes
2answers
112 views

Can an HTML-based patient report be HIPAA-compiliant?

Assume I am creating an application that generates a report of health recommendations based on input patient diagnostics. My application receives no identifying information about the patient. It ...
0
votes
1answer
611 views

NewMFA Requirement For HIPAA?

I was told by a vendor that there's new guidance effective in 2017 that mandates Multi-Factor Authentication for all systems that host PHI. They said that things like white-listing IP addresses was ...
1
vote
1answer
171 views

Under HIPAA, is it allowable to remember/store user credentials?

My medical chat application is handling PHI, and it enforcing unique, secure logins which ensure that only authorized / appropriate people can access that data. For now, I implemented touchID ...
2
votes
1answer
319 views

Best way to secure a cross-platform mobile app for HIPAA compliance

I'm developing a cross-platform, offline first mHealth application using Ionic 3 and Cordova which may need to be HIPAA compliant in the near future. It uses PouchDB as a client-side DB, HTTPS, at-...
1
vote
1answer
76 views

Application used in health industry: HIPAA HITECH hosting “requirements”

We have a scenario at my employer where we host an application that is used for uploading, storing, & managing documents related to patients' bills from healthcare providers. It is our knowledge ...
1
vote
0answers
43 views

certification to get in order to save PHI for European businesses

I work in a digital health company that will likely save personal Health information. I am conflicting what certification I best get in order to best meet the needs of business partners from Europe. ...
1
vote
0answers
121 views

What is EU-US security shield certificate means in term of EU PHI compliance

I'm facing a regulation issue. My servers are hosted on Google Cloud. I see that Google is HIPAA and Privacy Shield approved. If my database servers are hosted with Google and I'm storing personal ...
0
votes
2answers
312 views

How to achieve other security compliances/certifications on AWS after satisfying HIPAA?

Our infrastructure is built entirely on AWS and we went through the HIPAA process to ensure that our system is HIPAA-compliant. Where should we look or what next steps can we take to obtain other ...
1
vote
0answers
50 views

Is sending an audio file with a portion of an accession number a violation of HIPAA

Assuming a hypothetical scenario: The hospital radiology dictation system is down. The transcriptionist works off-site. The radiologist has the ability to record an audio file on his phone or laptop ...
0
votes
1answer
106 views

HIPAA compliance: how much does it matter? [closed]

I'm working with an android app sending data to a service hosted on AWS. The provider specifies that AWS in itself isn't HIPAA compliant. In which way should this by a source of worry? Regardless of ...
1
vote
0answers
59 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
1
vote
2answers
94 views

AWS HIPAA requires hardware dedicated to a single customer

Amazon HIPAA compliance requires customers to run on dedicated hardware (https://aws.amazon.com/compliance/hipaa-compliance/). I would think isolation of the operating system and encryption of data ...
1
vote
1answer
1k views

Can I send a Medical Record Number (MRN) via email internally? [closed]

We use Office 365, which might make a difference. Can I (legally) send an MRN, with no other demographic or health information, from me@mycompany.com to coworker@mycompany.com?
1
vote
1answer
639 views

Crosswalks (aka Matrix) for InfoSec Compliance Standards

Looking to find a reference that maps the various control standards (i.e. HIPAA, PCI-DSS, GLBA, ISO) to each other. I envision the answer being a spreadsheet that outlines the controls for one ...
0
votes
4answers
111 views

Is it okay to store this health data in a public cloud? [closed]

Is it okay to store relative health data in the public cloud, accessible by all users of my mobile app? Put another way, is this not considered PHI? For example: Bob has a resting heart rate of 40 ...
2
votes
1answer
103 views

Shared floor space, cameras and HIPAA compliance

I am a compliance associate at my company, which is a small call center. My problem is that two of our clients will have to share floor space. One client is tech support for high-end action cameras, ...
24
votes
6answers
8k views

Is it okay for our IT support contractor to remote in without authorization?

We are a healthcare IT company. My machine has PHI on it. Our IT contractor verbally asked if he could remote in to fix my printer so I said sure. I expected some sort of prompt to allow it but he ...
1
vote
0answers
25 views

HIPAA Related question regarding Prescription Rx Reports [closed]

This is a close approximation of my in-person conversation at the Local CVS: Me: Hi, I'd like to get the 2015 Medication Report for myself and my wife. Clerk: I can print yours, if you have Photo ID,...
2
votes
1answer
467 views

Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc

Are there any requirements in PCI or HIPAA, or other security standards that may impact general government, payment processing, healthcare, that would disqualify any CA vendors that are trusted by the ...
4
votes
2answers
1k views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
8
votes
1answer
137 views

Is Google identity sign in product HIPAA compliant?

I want to use this product to save me a month of coding. Looking for a product that Password expiration forgot password system lock after x times of wrong password Valid passwords rules (min 8 ...
1
vote
0answers
20 views

Is a business associates contract required to use hosted R&D services? [closed]

I'm on the "configuration management" team which, among other things, means I'm responsible for R&D systems, like: source control, issue tracking, team collaboration (wiki), etc. These are not ...
4
votes
0answers
106 views

HIPAA/FISMA certification for IT audits [closed]

I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
2
votes
0answers
102 views

Does our support chat need to be HIPAA compliant? [closed]

We are currently using olark to provide an instant chat support feature to our customers. Customer typically ask about outages, setup issues, etc. We are in the process of trying to become HIPAA ...
2
votes
3answers
4k views

Can name, DOB and ID be PHI?

Can a person's name, date of birth and proprietary ID be considered as PHI? Ex: Joe Doe, 11/25/1955, 45698745236.
2
votes
1answer
126 views

Avoiding HIPAA, part 2

I'm building a new website, that may be subject to HIPAA. But I won't normally need access to the data. If I encrypt, or somehow encode, the personally identifiable parts, so only the user can decrypt ...
1
vote
2answers
296 views

Avoiding HIPAA, will this work?

I'm building a new website, and I'm trying to figure out if I need to worry about HIPAA. And if I do, I'm trying to figure out a way I can stop worrying about HIPAA. An example of something kinda ...
0
votes
1answer
148 views

“If encryption has not been implemented, a comparable alternative has been implemented” [closed]

What constitutes as a comparable alternative to encryption? I know that password keepers and other services are not comparable and are not considered encryption. If the context is authorized access ...
2
votes
0answers
311 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
8
votes
4answers
3k views

Proper implementation of HIPAA within iOS app with several factors

We are developing an iOS app that allows users to store/modify Protected Health Information (PHI) and the app needs to allow users to do so without an internet connection for large parts of the ...
7
votes
1answer
1k views

What is legally required to store HIPAA data in the “cloud”?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would ...
2
votes
1answer
268 views

Hushmails “Secure Forms” & HIPAA

I just picked up a job for integrating Hushmail's Secure Web Forms into a medical website. The forms will submit patient's (PHI) data to Hushmail's servers, encrypt the data, and then send it to their ...
2
votes
1answer
1k views

Is FileVault 2 HIPAA compliant?

It looks to me like FileVault 2 uses AES 256 bit encryption for the desk. Does that mean that it meets the HIPAA "data at rest" standard? Is there something else I need to check about it?
2
votes
1answer
2k views

Are internal patient identifiers considered PHI under HIPAA?

We use GUIDs to internally to identify patients in our system. I'm having a debate with our regulatory people on whether these identifiers can be used in query strings to REST calls. They are ...