4 ms·
PHI must only be collected on platforms that are certified for PHI. Collection PHI on platforms not certified for PHI is a HIPAA violation and a good way to ge
by WkndTriathlete 4y ago
PHI must only be collected on platforms that are certified for PHI. Collection PHI on platforms not certified for PHI is a HIPAA violation and a good way to get sued for all of your dollars x10, as well as criminal proceedings.
Fully-anonymized PHI can be analyzed on anything but the anonymization process must also be certified to have a reasonably low risk of re-identification when combined with other (arbitrary) datasets.
(source: I used to implement and certify PHI data collection platforms.)
- dragonwriter 4y ago> Collection PHI on platforms not certified for PHI is a HIPAA violation No, it's not. (There are compliance reauirements, both direct and implicit on the HITECH definition of secured PHI, but “certified for PHI” is not one of them, despite marketing myths spread by the private HIPAA certification industry, which pedals certifications without legal meaning.) > a good way to get sued for all of your dollars x10, HIPAA penalties are capped at a penalty of $1.5 million per year for violations of any single provision, regardless of number of violations (and $50k per violation).
- draebek 4y agoFor the record, I believe extreme violations of HIPAA can result in criminal charges, or so I've read. (Accidentally sending PHI to New Relic almost certainly does not qualify for jail time.)
- heavyset_go 4y agoMost companies that deal with PHI are not covered entities, or their partners, that HIPAA restrictions apply to.