HIPAA Health Information Privacy, Security and Breach Notification Rules

About HIPAA
Health App Use Scenarios & HIPAA
Guidance on HIPAA & Cloud Computing
Engage with OCR on issues & concerns related to protecting health information privacy in mHealth design and development
Submit & View Questions
About

Popular Questions

Text messaging an...

by Community Member

There is currently a lack of clarity about whether patient consent to communicate via (unencrypted) SMS is adequate to protect covered entities fro...

19 votes     15 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applies t...

8 votes     4 comments

Can HIPAA address...

by Community Member

Developers need better guidance around patient generated health data, since HIPAA focusses on one-way data sharing from a provider/other covered en...

6 votes     7 comments

Help with busines...

by Community Member

There is a lack of transparency around the content of Business Associate Agreements (BAAs), a lack of sample BAA language around the topics develop...

5 votes     3 comments

New Questions

Providers feed PH...

by Community Member

You have an app to manage chronic care that is primarily driven by the patient and requires patient persmission to share any data, but where provid...

1 votes     0 comments

What does "on beh...

by Community Member

What triggers acting "on behalf of a covered entity", A, or B, or other? A. A covered entity uses your app (you are not paid or have signed a BA; t...

1 votes     0 comments

Does the name of ...

by Community Member

Does having identifiable information of a person and the name of the health insurance company they are enrolled in (or name of other covered entity...

1 votes     0 comments

When is PHI de-id...

by Community Member

We have developed a platform to facilitate the scheduling of transport/rides for patients to provider appointments. The process works as follows....

1 votes     0 comments

Random Questions

Offshore developm...

by Community Member

Does HIPAA have any restrictions on offshore development and/or customer support functions if the parent company is based in U.S. and/or if the for...

1 votes     1 comments

Unencrypted PHI i...

by Community Member

From Kevin Wiggins, Saul Ewing: If a CE puts PHI on the Cloud and later terminates that Cloud as a service provider, there is inevitably some data...

1 votes     2 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applies t...

8 votes     4 comments

PII and PHI

by Community Member

We make medical devices and sell to CEs through a independent sales team/resellers. Often times where there are some issues with software that runs...

2 votes     0 comments