HIPAA Health Information Privacy, Security and Breach Notification Rules

About HIPAA
Health App Use Scenarios & HIPAA
Guidance on HIPAA & Cloud Computing
Engage with OCR on issues & concerns related to protecting health information privacy in mHealth design and development
Submit & View Questions
About

Popular Questions

Text messaging an...

by Community Member

There is currently a lack of clarity about whether patient consent to communicate via (unencrypted) SMS is adequate to protect covered entities ...

23 votes     17 comments

PHI request throu...

by Community Member

I understand there is some ambiguity regarding providers communicating PHI with patients, and I'm having some trouble interpreting how it applie...

9 votes     4 comments

Is a BAA required...

by Community Member

If my provider is communicating PHI and non-PHI with patients through a 3rd party SMS service, such as Twilio, would my provider be required to ...

7 votes     1 comments

Can HIPAA address...

by Community Member

Developers need better guidance around patient generated health data, since HIPAA focusses on one-way data sharing from a provider/other covered...

6 votes     11 comments

New Questions

OCR involvement a...

by Community Member

What is the intent of this site? OCR rarely, if ever comments on questions, some of which could really help HIPAA regulated organizations and de...

1 votes     1 comments

Web Based Portal ...

by Community Member

If a DME supplier, vitamin supplier, text reminder application, auto payment system for patient accounts, or a website management company colle...

2 votes     2 comments

Research or a hea...

by Community Member

Does developing an algorithm/machine learning system that uses PHI from EMR to predict and alert providers to negative health outcomes constitut...

1 votes     0 comments

BAA and CI/CD too...

by Community Member

Many third party tools exist for Continuous Integration and Continuous Development (CI/CD). While an organization may maintain a BAA with their ...

2 votes     0 comments

Random Questions

Are Cloud Storage...

by Community Member

Is a company that provides encrypted cloud storage for a covered entity a BA if it does not have the encryption key and has no ability to access...

2 votes     2 comments

Unencrypted Text ...

by Community Member

Can a provider, or business associate acting on behalf of a provider, send an unencrypted text or email to a patient if the initial message does...

2 votes     0 comments

When are end-user...

by Community Member

I'm a compliance consultant for early stage startups with tight budgets. I'm not sure how to advise them regarding BAAs for third-party services...

1 votes     3 comments

Which video chat ...

by Community Member

Is Skype or any other video chat app HIPAA-compliant? Which video chat apps can currently be used for telehealth treatment activities involving ...

1 votes     2 comments