HIPAA Health Information Privacy, Security and Breach Notification Rules

About HIPAA
Health App Use Scenarios & HIPAA
Guidance on HIPAA & Cloud Computing
Engage with OCR on issues & concerns related to protecting health information privacy in mHealth design and development
Submit & View Questions
About

Popular Questions

Text messaging an...

by Community Member

There is currently a lack of clarity about whether patient consent to communicate via (unencrypted) SMS is adequate to protect covered entities fro...

23 votes     17 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applies t...

9 votes     4 comments

Is a BAA required...

by Community Member

If my provider is communicating PHI and non-PHI with patients through a 3rd party SMS service, such as Twilio, would my provider be required to sig...

7 votes     1 comments

Can HIPAA address...

by Community Member

Developers need better guidance around patient generated health data, since HIPAA focusses on one-way data sharing from a provider/other covered en...

6 votes     10 comments

New Questions

Hippa and company...

by Community Member

Our company allows employees to have company email on our BYOD's we are wonder what is needed to insure our email, and mobile devices are HIPPA com...

2 votes     1 comments

HTTPS Communicati...

by Community Member

Hi, We are trying to send medical data from clinics to an Amazon S3 service via an https connection (using an API). The S3 is configured with a po...

2 votes     2 comments

Are all cookies c...

by Community Member

One of our physicians requested the use of a website which requires a patient to create an account, then the physician can add medical information ...

1 votes     0 comments

Wearables provide...

by Community Member

I believe this question is covered in the developer guidance (page 3), but as this document is 3+ years old, I was trying to determine if further g...

1 votes     0 comments

Random Questions

Unencrypted Text ...

by Community Member

Can a provider, or business associate acting on behalf of a provider, send an unencrypted text or email to a patient if the initial message does no...

1 votes     0 comments

HIPAA compliance ...

by Community Member

I'm working on an app for a therapist to send a list of exercises to their patient's mobile device from their desktop for the patient to perform at...

2 votes     0 comments

Must a mobile app...

by Community Member

A covered entity provides test results to patients through a Patient Mobile App or a Website. Patients must request access and data is transmitte...

1 votes     0 comments

Cloud computing

by Community Member

Developers need better guidance around cloud storage/computing and the Security Rule. Client-server architecture is no longer relevant in many cas...

3 votes     2 comments