4 ms·
Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0] Basically, i
by SkyPuncher 7y ago
Just an FYI, two weeks ago, CMS announced it would be suspending enforcement of telehealth tools used in good faith during the COVID pandemic. [0]
Basically, if you are a family doc that's been thrown into the telehealth ringer, you can get started with everyday tools for video chat, like Facetime, Google Hangouts, Skype, etc - regardless of that tool's Hipaa compliance.
Overtime I do expect they'll want to see providers transition to compliant solutions, but they understand thousands of doctors, some of whom have never delivered telemedicine, can't simply audit and on-boarding a new provider overnight.
[0] https://www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet https://www.cms.gov/newsroom/fact-sheets/medicare-telemedici...
- SamuelAdams 7y agoNote this only applies to the USA, other countries might not have loosened their regulations quite yet.
- rubatuga 7y agoExtremely loose in Canada as well. Facetime, skype, phone calls are all fair game currently
- marcinzm 7y agoAs a note, HIPAA does not require end-to-end encryption as long as you have a BAA with the provider. Zoom has an option for a BAA starting at $200/month. edit: Server-client communication does need to be encrypted which zoom does.
- biggc 7y agoWhat is a BAA?
- lvh 7y agoA BAA is a Business Associate Agreement. It's a standard HIPAA document where an entity with PHI (typically a Covered Entity, which is an entity specifically mentioned by HIPAA, such as e.g. a healthcare facility) effectively puts a vendor on notice: we may stuff PHI in your service, you agree to abide by this set of rules and regulations. A big one is that the vendor agrees to disclose when they've been breached, and the timeline on which that happens. Even though a lot of online sources suggest BAAs are only for Covered Entities, that's not strictly speaking true. The standard form document doesn't require the buyer to certify they're a CE. It makes tons of sense for vendors of CEs, themselves bound by BAAs, to bind _their_ vendors to BAAs! If there's a decent chance your customers put PHI in your service, there's a decent chance they put PHI in your support system, and they don't really care if your support system is something in-house or Zendesk when that happens. There's also a good chance that PHI might end up in your logging system, and from there in your Slack instance, and... before you know it everyone's signed a BAA with everyone. The life-hack consequence for that is that you can just collect BAAs from anyone who will sign them and now you have disclosure timeline guarantees.
- jonny_eh 7y agoPHI: Protected Health Information. I figured someone asking what BAA stands for doesn't necessarily know all the other acronyms. Edit: Fixed definition!
- closeparen 7y agoProtected, not Personal.
- jonny_eh 7y agoFixed, thanks!
- jiveturkey 7y ago> disclosure timeline guarantees. depends on your definition of "guarantee". what you really have is externalisation of risk.
- marcinzm 7y agoBusiness Associate Agreement. A contract which defined how protected health information will be dealt with by the provider and how HIPAA provisions will be followed (ie: provider will do X but you need to do Y to be compliant). https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- schwank 7y agoBusiness Associate Agreement, which defines the legal requirements between two parties sharing HIPAA data.
- chasb 7y agoI wrote this a while back for our customers: https://www.aptible.com/hipaa/what-is-a-baa/ https://www.aptible.com/hipaa/what-is-a-baa/
- lvh 7y agoThe Security Rule and Transmission Control Standard mention encryption, but as Addressable, not Required, if memory serves. That means you have to do it if it's "reasonable and appropriate", and in this context they just mean transport encryption like TLS, not Signal-style actual E2E. Not that you shouldn't, of course. And you better have an excuse for not doing it (e.g. we don't re-encrypt after the load balancer terminates TLS is a common one). But doctor's offices fax stuff to each other all the time, and that certainly is not encrypted. Perhaps you're thinking of a HITRUST control? (Minor nit: HIPAA, not HIPPA.)
- SkyPuncher 7y agoIt's a bit more nuanced. Hipaa (two a's) does not require the type end-to-end encryption that most devs come to think of. Generally, Hipaa does require transport encryption from the client to the server processing the request. The importance here is SSL/TLS should be terminated at the app server.
- deleted 7y ago[deleted]
- lonelappde 7y agoHIPAA (all caps)
- deleted 7y ago[deleted]
- Gaelan 7y agoFaceTime is E2E, fwiw, although it might not comply with other requirements.