I'm developing a calculator type app for a friend of mine who works at a skilled nursing facility.
She works as a therapist and regularly needs to split the total amount of time she needs to work with her patients into multiple sessions, often switching back and forth between patients. I'm developing the app to automate the task of her writing down when she starts and ends each session with each of per patients... and if the total amount of minutes she's worked meets or exceeds the amount of time she's required to spend with each patient that day. It basically just automates the task of doing the calculation.
The information it records for each of her patients is:
1) The patient's initials
2) The total amount of time in minutes that she's expected to work with the patient
3) The times she chooses to work with them. (for example session 1 might go from 12:45pm to 1:30pm, session 2 might go from 2:30pm to 3:00pm or whenever else she chooses.
What it doesn't record:
1) Specific dates related to treatment (it only records a time like 12:45pm)
2) Any information regarding what they're being treated for or how they're being treated.
I believe I've read that a patient's initials are considered "identifying information" but I've also read that it's about the relationship to the health information that determines whether an app needs to be compliant. What I'm not sure about is whether these three pieces of information taken together are enough that I need to worry about being hippa compliant? I'm just trying to create a simple calculator to help her make sure she's getting her minutes in with each patient. I read somewhere else that some apps that just automate tasks like this fall into a "minimum risk" type of category. I wonder if my app would fall into that and not need to comply?
If the initials are what gets me into trouble, I could just automatically number them Patient 1, 2, 3, etc. and she would need to keep track of who is who outside of the app.
I figure the calculator app we all have on our phones doesn't need to be hippa compliant. I'm trying to be that for therapists and anyone else who might need to calculate sessions like this.