HIPAA Health Information Privacy, Security and Breach Notification Rules

About HIPAA
Health App Use Scenarios & HIPAA
Guidance on HIPAA & Cloud Computing
Engage with OCR on issues & concerns related to protecting health information privacy in mHealth design and development
Submit & View Questions
About

Popular Questions

Text messaging an...

by Community Member

There is currently a lack of clarity about whether patient consent to communicate via (unencrypted) SMS is adequate to protect covered entities fro...

23 votes     16 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applies t...

9 votes     4 comments

Can HIPAA address...

by Community Member

Developers need better guidance around patient generated health data, since HIPAA focusses on one-way data sharing from a provider/other covered en...

6 votes     10 comments

Is a BAA required...

by Community Member

If my provider is communicating PHI and non-PHI with patients through a 3rd party SMS service, such as Twilio, would my provider be required to sig...

6 votes     1 comments

New Questions

How to handle old...

by Community Member

I'm a web designer and have a client who has recently become hipaa compliant concerning his handling of email. He needed me to search his old email...

1 votes     0 comments

Surveillance Came...

by Community Member

The mental health organization I am working with wants to install cameras in an area where people receive services (so they are identified by face ...

1 votes     0 comments

iOS keychains for...

by Community Member

I am building a mobile application to facilitate the patients and I am accessing the PHI through RESTful web apis. I want to clarify one thing that...

1 votes     0 comments

Is a state-run MM...

by Community Member

Is a state-run medical marijuana patient registry a covered entity? The Florida registry includes identifiable patient personal information and MMJ...

2 votes     1 comments

Random Questions

De-identification...

by Community Member

Is there any limitation on a covered entity's de-identification of PHI or use of de-identified information? For example, may a covered entity de-id...

3 votes     2 comments

HIPAA Program Com...

by Community Member

This was addressed on your old FAQ page for a number of years and it seems to have disappeared. Can "open format" postcards still be used to remind...

2 votes     0 comments

Implementations w...

by Community Member

When implementing external services with clients (such as exposing an API to external clients), are there any HIPAA rules/regulations around testin...

0 votes     0 comments

App Customization

by Community Member

A consumer focused app receives a request from one of its users, a hospital, for a customization of the product. The customization is created in re...

2 votes     1 comments