화요일, 4월 16, 2024
HomeHealth LawIs Your Web site HIPAA-Compliant? | HIPAA & Well being Data Expertise

Is Your Web site HIPAA-Compliant? | HIPAA & Well being Data Expertise


In case you are a HIPAA-covered entity or enterprise affiliate, you probably know that affected person PHI might solely be created, acquired, maintained, and transmitted as permitted by the HIPAA Safety Rule and the HIPAA Privateness Rule.  But chances are you’ll not have targeted in your firm’s web site as a spot the place PHI is collected and transmitted.  In case you are topic to HIPAA, you need to regularly assess your web site knowledge practices.  As described on this weblog put up, you need to be sure that third-party trackers like Meta Pixel aren’t accessing and disclosing knowledge behind the scenes.  However widespread customer-facing instruments shouldn’t be neglected.  Frequent methods wherein PHI could also be collected and transmitted embrace:

  • Stay Chat
  • Affected person Portals
  • On-line Affected person Kinds
  • On-line Scheduling Instruments
  • Evaluations and Testimonials
  • E-mail
  • On-line loyalty Packages

The HIPAA Privateness Rule requires that entities that create, obtain, preserve, and/or transmit PHI take particular measures to guard it. For instance, if your organization retains individually identifiable medical info on a server, that server should be encrypted and safe. Transmitting PHI contains sending info by way of e-mail, textual content, net varieties or different varieties of digital messaging. Storing PHI contains storing info in apps, knowledge facilities, and so forth. If your organization web site collects, shops, or transmits PHI and doesn’t take cheap measures to safe that knowledge, it might violate HIPAA.

To start remediating dangers, corporations ought to:

  • Buy and implement an SSL certificates for the corporate web site
  • Guarantee all net varieties on the corporate web site are encrypted and safe
  • Solely ship emails containing PHI by encrypted e-mail servers
  • Accomplice with website hosting corporations which might be HIPAA-compliant and have processes for shielding PHI
  • Execute BAAs with third events which have entry to PHI (together with website hosting corporations)
  • Make sure that PHI is simply accessible by licensed people inside your organization
RELATED ARTICLES
RELATED ARTICLES

Most Popular