HIPAA Health Information Privacy, Security and Breach Notification Rules

About HIPAA
Health App Use Scenarios & HIPAA
Guidance on HIPAA & Cloud Computing
Engage with OCR on issues & concerns related to protecting health information privacy in mHealth design and development
Submit & View Questions
About

Popular Questions

Text messaging an...

by Community Member

There is currently a lack of clarity about whether patient consent to communicate via (unencrypted) SMS is adequate to protect covered entities fro...

23 votes     16 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applies t...

9 votes     4 comments

Can HIPAA address...

by Community Member

Developers need better guidance around patient generated health data, since HIPAA focusses on one-way data sharing from a provider/other covered en...

6 votes     10 comments

Is a BAA required...

by Community Member

If my provider is communicating PHI and non-PHI with patients through a 3rd party SMS service, such as Twilio, would my provider be required to sig...

6 votes     1 comments

New Questions

Is a state-run MM...

by Community Member

Is a state-run medical marijuana patient registry a covered entity? The Florida registry includes identifiable patient personal information and MMJ...

1 votes     1 comments

Is my App followi...

by Community Member

I email addresses of the users of the app, which are all doctors not patients, for authentication purposes. The application uses SSL encryption f...

1 votes     0 comments

Whether App is tr...

by Community Member

I have mobile application for tracking physician compensation, and I'm not sure if it contains data points separately or together which would be co...

1 votes     0 comments

online social com...

by Community Member

We are a covered entity, and developing an online education program for a medical condition. Only registered/approved users are able to join view p...

1 votes     0 comments

Random Questions

Hospital Outpatie...

by Community Member

If a patient acknowledges receipt of a Notice of Privacy Practices when admitted to a Hospital, does the Hospital-owned outpatient pharmacy using t...

3 votes     0 comments

Notifications

by Community Member

A NYS licensed facility providing addiction treatment services has been advised that when a patient has been referred for treatment by another enti...

2 votes     0 comments

Ransomeware Attack

by Community Member

I just heard that a practice in our area had a ransomware attack. Based upon their investigation their manager stated that the hacker did not get a...

-1 votes     0 comments

De-identification...

by Community Member

Is there any limitation on a covered entity's de-identification of PHI or use of de-identified information? For example, may a covered entity de-id...

3 votes     2 comments