If you’re a HIPAA-covered entity or enterprise affiliate, you probably know that affected person PHI could solely be created, acquired, maintained, and transmitted as permitted by the HIPAA Safety Rule and the HIPAA Privateness Rule. But you could not have targeted in your firm’s web site as a spot the place PHI is collected and transmitted. If you’re topic to HIPAA, it is best to regularly assess your web site information practices. As described on this weblog publish, it is best to be certain that third-party trackers like Meta Pixel are usually not accessing and disclosing information behind the scenes. However widespread customer-facing instruments shouldn’t be neglected. Frequent methods during which PHI could also be collected and transmitted embrace:
- Dwell Chat
- Affected person Portals
- On-line Affected person Types
- On-line Scheduling Instruments
- Opinions and Testimonials
- Electronic mail
- On-line loyalty Applications
The HIPAA Privateness Rule requires that entities that create, obtain, preserve, and/or transmit PHI take particular measures to guard it. For instance, if your organization retains individually identifiable medical data on a server, that server should be encrypted and safe. Transmitting PHI contains sending data through electronic mail, textual content, internet varieties or different sorts of digital messaging. Storing PHI contains storing data in apps, information facilities, and so on. If your organization web site collects, shops, or transmits PHI and doesn’t take affordable measures to safe that information, it could violate HIPAA.
To start remediating dangers, corporations ought to:
- Buy and implement an SSL certificates for the corporate web site
- Guarantee all internet varieties on the corporate web site are encrypted and safe
- Solely ship emails containing PHI by encrypted electronic mail servers
- Companion with webhosting corporations which can be HIPAA-compliant and have processes for safeguarding PHI
- Execute BAAs with third events which have entry to PHI (together with webhosting corporations)
- Make sure that PHI is barely accessible by approved people inside your organization
Ransomware Assaults In opposition to Healthcare Suppliers Proceed to Enhance