6
votes
Accepted
Bad medical security
I had a similar issue in the past. Security is a rapidly-changing field, and it's easy for small companies to convince themselves they don't need to worry about security breaches. (and well...if you ...
- 76
5
votes
Can an HTML-based patient report be HIPAA-compiliant?
Yes, an HTML based report can be HIPAA compliant.
The format in which the report is presented has no significant consequence to compliance. The behavior of the system that is generating the report is ...
- 126
4
votes
Accepted
Is it safe to keep decrypted data in memory?
The short answer is: Just don't.
The long answer is: It depends on the rest of the system.
As ram0nvaldez said, you have to decrypt the data to work with it. Some level of decrypted in-memory is ...
- 166
4
votes
Can I say that my web app is HIPAA compliant?
Well no - you get a third party to audit your controls and they sign off and say you are HIPAA compliant. Its the whole seperation of duties thing your company builds it and a independant trustworthy ...
- 3,270
4
votes
Can name, DOB and ID be PHI?
Yes, they can - but not only due to name and DOB. Those alone only constitute personally identifiable information (PII).
However, combined with a unique identifier that can be used to link to health ...
- 41
4
votes
Cisco Registered Envelope Service (CRES), big security flaw?
I'm actually the guy that invented the Cisco Registered Envelope. It was created in a startup called PostX originally. In the beginning we didn't do registration like that we made customer supply ...
- 41
3
votes
Can name, DOB and ID be PHI?
No. Name, date of birth, and a unique identifier, in isolation, do not constitute protected health information because they do not meet the definition of "health information" as defined in the Health ...
- 131
3
votes
Accepted
HIPAA compliance: how much does it matter?
All the comments posted before this are correct - unless this is a healthcare application, it probably shouldn't make a difference. The statement you're talking about is probably just to help ...
- 3,414
2
votes
Is Google Analytics HIPAA compliant? How can I find out?
Google Analytics is not HIPAA compliant. Even sending page titles to Google Analytics can be seen as a HIPAA violation, if the page titles are descriptive enough. From Google:
Unless otherwise ...
- 21
2
votes
Can PHI be HIPAA compliant on a cloud?
I know this is an older topic, but it is still #1 on Google Search so I figured I'd add some clarification. HHS actually provided pretty clear guidance on this issue (for once) and this article is a ...
2
votes
Accepted
AWS HIPAA requires hardware dedicated to a single customer
Not using dedicated hardware can lead to information leakage due to shared caches, compromised hypervisors (due to various timing-based side channels, and other issues due to uncertain performance ...
- 4,006
2
votes
NewMFA Requirement For HIPAA?
HIPAA doesn't explicitly mandate MFA, but because of updates to NIST guidance (800-63), it would be very reasonable to argue that a solution without MFA is deficient to meet something like section 164....
- 1,078
2
votes
Accepted
How does TrueVault's de-identification process work?
TrueVault recommends doing data de-identification and re-identification client side (within your web or mobile app logic). This makes two interesting flows:
De-Identification
Data is entered into ...
- 136
2
votes
For HIPAA, Does US Patient Data Have To Stay On US Servers?
It would seem that data can be stored abroad, but the location of service
and any extra risks would need to be considered.
9. Do the HIPAA Rules allow a covered entity or business associate to ...
- 3,197
2
votes
How does a pentesting engagement change under HIPAA?
:::Not Legal Advice:::
HIPAA does not specify a pen test requirement, although it's generally understood to be part of the regular technical security assessment requirements. HIPAA does not dictate ...
- 2,260
1
vote
HIPAA Compliance for Frontend Hosting
I asked the Security team in our company (Platform.sh) what they advise in such cases. Here's what they responded:
You can probably make something like that work but you need to be careful so that no ...
- 111
1
vote
How to secure data on production environment
In some environments like yours, I've implemented a remote environment (RDP in my case) where the engineer can interact with the system, but cannot download to the local machine.
Yes, it is possible ...
- 132k
1
vote
Is it safe to keep decrypted data in memory?
In any case, all data will be unencrypted to be processed, once finished the processing will be encrypted again in storage.
The regulations mainly have to do with storage, so you are good. Remember ...
- 204
1
vote
Need of Encryption for storing Health Information
That’s a pretty broad set of questions.
1 Can a case be made for added asymmetric + symmetric encryption of
data in transit over TLS v1.3?
According to what you wrote, at the very least either ...
- 34.7k
1
vote
Is sending an Email without any PHI violates HIPAA privacy rule?
What if the email that is been sent only contain a link to login and nothing else ?
You are good to go. There is nothing to worry about if you send the mail which consists of link that asks the ...
- 573
1
vote
What is the point of HIPAA de-identification + re-identification?
Note: I can't give legal advice. This is speculation. I'm not qualified in this area so I also don't know whether this is accurate.
I believe that it's common for clinics to draw patients' blood but ...
- 1,766
1
vote
Accepted
Would it be HIPAA compliant to share docs with EHR data between two HIPAA compliant Gsuite organizations
If as you say, both entities have entered into a business associate agreement with Google they are able to use G Suite for PHI sharing. Google supports HIPAA compliance for G Suite). Provided the ...
- 56
1
vote
Under HIPAA, is it allowable to remember/store user credentials?
The security rule of HIPAA doesn't specifically address this. However, if you can prove that touchID requires actual validation of whomever is authorized for the ePHI for access-- then it suffices. ...
- 177
1
vote
Accepted
Best way to secure a cross-platform mobile app for HIPAA compliance
It's going to depend on the details your specific situation, but I believe encryption on the client may be required in your instance. The following sample questions are posed by the HSS Technical ...
- 3,322
1
vote
Application used in health industry: HIPAA HITECH hosting "requirements"
You are not off base on your assessment. Putting PHI in the cloud means that that provider is now responsible for compliance. They now play an important part in the chain of custody of the PHI.
BAAs ...
- 11
1
vote
How to achieve other security compliances/certifications on AWS after satisfying HIPAA?
In order to be HIPAA compliant, you should have verified a substantial amount of your configuration is properly secured, otherwise you or your client will be subject to the financial penalties which ...
- 390
1
vote
How to achieve other security compliances/certifications on AWS after satisfying HIPAA?
That entire depends on what certification you are looking for. If you are looking to become PCI-DSS compliant as well, you have companies that will walk you through the process/ do the certification ...
- 484
1
vote
Accepted
Approved Certificate Authorities for certification/compliance with HIPAA, PCI etc
I’ll address HIPAA first, since it is an actual regulation you are required to comply with (assuming you are s covered entity) whereas PCI compliance is a contractual requirement imposed upon ...
1
vote
Proper implementation of HIPAA within iOS app with several factors
I know this is a rather old question, but I came across it as part of another search and figured I'd throw out one more idea here in case others are facing similar challenges.
You may want to look at ...
- 11
1
vote
Is conveying patient MRN in a web service URL a HIPAA PHI violation?
My reading of §164.514 Other requirements relating to uses and disclosures of protected health information (page 96+ of the pdf) is that if you have no health information in the request, logs, url, ...
- 115
Only top scored, non community-wiki answers of a minimum length are eligible