If you are part of the medical community, you are probably well aware of HIPAA, and the importance of maintaining compliance when it comes to Protected Health Information (PHI). But, do you really understand what you need to do to make sure your web application development for your website is HIPAA compliant?

Web applications associated to your practice and your website are a great way for patients to interact with their healthcare providers. From accessing test results and paying bills to scheduling appointments, things like patient portals help free up medical staff and enhance productivity. Here are some things you need to be aware of regarding your web app development when it comes to HIPAA compliance.

Is My Web App HIPAA Compliant?

In order for your app to be HIPAA compliant, you need to make certain the following is in place:

·       Data Transport Encryption: Chances are that the data on your generic website is not encrypted before or during transmission. HIPAA requires that any ePHI (electronic Protected Health Information) be encrypted prior to being transmitted.

·       Backup: Your current website server might have a backup, as most web hosts provide backup and restoration features. HIPAA requires that ePHI is backed up for recovery and restoration, if needed. But, do you know if the location of those backup files is HIPAA compliant, too? If not, you may have just unlawfully shared PHI. Anybody hosting, maintaining, or monitoring server space containing PHI should adhere to the Business Associate Agreement, addressed below.

·       Authorization: You may already have authorization in place on your medical app, or you may not. This needs to be confirmed. The only people who should have access to ePHI are authorized staff members trained and versed in HIPAA compliance rules, or a serious breach could easily occur.

·       Data Integrity: On a generic website or app, there is no guarantee that data has not been modified. You must make certain that ePHI is not subject to unsanctioned changes.

·       Storage Encryption: Generic websites do not encrypt stored data. Stored data must be encrypted to ensure patient privacy.

·       Disposal: This might already exist on a generic website.  Just be aware that some web hosting providers store backups indefinitely. You must make sure that once ePHI is no longer needed, it can be safely and permanently disposed of.

·       Business Associate Agreement: Many web hosting providers do not know what HIPAA is, and will be reluctant to run any risks signing the HIPAA Business Associate Agreement, which might contradict their own business processes. It is imperative that your ePHI is hosted on servers of a company with whom a Business Associate Agreement is in place, and signed. The alternative is to host your ePHI on secure in-house servers.

It is important to note that every vendor that deals with your patient health data must sign a Business Associate Agreement in order for you to be HIPAA compliant. It is imperative that your web hosting provider follows security requirements and provides infrastructure that is HIPAA compliant. The same is true for website design and functionality.

Privacy Policy

It is strongly encouraged that health app developers and any party associated with a website or app – that must be HIPAA compliant due to hosting patient health information – acknowledge and accept a well-defined privacy policy. This is not the same as a notice of privacy practices, as it signifies individual responsibility towards protecting patient rights.

Need Help?

HIPAA compliance can be complex, and breaches are messy and costly. It is important that your business understands what is necessary and appropriate to protect ePHI during the creation and maintenance of healthcare applications and websites.

If you are concerned about your business’s privacy and security needs and HIPAA compliance, contact us at 800-733-6379. We are experts in the field of HIPAA rules and procedures. Colington Consulting can help you avoid reputation problems and steep fines, by bringing your business into complete HIPAA compliance. It is what we do best, allowing you to do what you do best…provide health care to your patients.

This blog was previously posted February 14, 2018