3 ms·

Not hipaa compliant for one

rchaud 3y ago
Online therapy doesn't have to be HIPAA compliant on technology used to communicate with the client. If the client wants to use FaceTime, they have to inform them that it's not HIPAA-compliant and confirm that they're OK to continue. HIPAA comes into play if the therapist wants to securely share client care notes with another care provider.
- hellotheretoday 3y ago
  This is true. That said the agreement with the insurance provider or billing processer often requires a hipaa compliant platform with a BAA. I bill through the headway platform as an example and they require a hipaa compliant telehealth platform with BAA for processing. In addition I believe my contract with Aetna specifies the same although it’s been awhile since I’ve reviewed it tbf. an interesting question that comes up for me is whether these companies are harvesting content of meetings and chats for training models and whatnot. The BAA is a (small) protection for myself in case it turns out that zoom is training their AI assistant on meeting chats or closed captioning without participant consent. Although I would hope that the liability in that scenario would mostly fall on zoom as that’s really an abuse on their part.
kawfey 3y ago
honestly I trust the security of FaceTime or Zoom more than that of third party telehealth apps.
- hellotheretoday 3y ago
  Sure but zoom is hipaa compliant and FaceTime is not. Apple refuses to share a business associate agreement whereas zoom shares this with paid plans. I do agree that I seriously question the security of the small telehealth platforms that cropped up during Covid though, hipaa compliant or not. I am certain apple does security significantly better than simplepractice, doxy.me, etc but it’s the regulatory piece of handling PHI. The BAA is essential to that and apple/discord/etc have made it clear through their silence after years that they don’t want to be responsible for safe data handling of phi. Bottom line though is if your therapist is using FaceTime/discord/etc they are ignorant to hipaa protocols or not practicing ethically, both are concerning. Very frustrating from a consumer perspective because how the fuck are you supposed to know what is and isn’t hipaa compliant. It’s silly to have to research whether your clinician is using a regulatory compliant platform but here we are, I guess

Online therapy doesn't have to be HIPAA compliant on technology used to communicate with the client. If the client wants to use FaceTime, they have to inform them that it's not HIPAA-compliant and confirm that they're OK to continue. HIPAA comes into play if the therapist wants to securely share client care notes with another care provider.

hellotheretoday 3y ago
This is true. That said the agreement with the insurance provider or billing processer often requires a hipaa compliant platform with a BAA. I bill through the headway platform as an example and they require a hipaa compliant telehealth platform with BAA for processing. In addition I believe my contract with Aetna specifies the same although it’s been awhile since I’ve reviewed it tbf. an interesting question that comes up for me is whether these companies are harvesting content of meetings and chats for training models and whatnot. The BAA is a (small) protection for myself in case it turns out that zoom is training their AI assistant on meeting chats or closed captioning without participant consent. Although I would hope that the liability in that scenario would mostly fall on zoom as that’s really an abuse on their part.

kawfey 3y ago

honestly I trust the security of FaceTime or Zoom more than that of third party telehealth apps.

hellotheretoday 3y ago
Sure but zoom is hipaa compliant and FaceTime is not. Apple refuses to share a business associate agreement whereas zoom shares this with paid plans. I do agree that I seriously question the security of the small telehealth platforms that cropped up during Covid though, hipaa compliant or not. I am certain apple does security significantly better than simplepractice, doxy.me, etc but it’s the regulatory piece of handling PHI. The BAA is essential to that and apple/discord/etc have made it clear through their silence after years that they don’t want to be responsible for safe data handling of phi. Bottom line though is if your therapist is using FaceTime/discord/etc they are ignorant to hipaa protocols or not practicing ethically, both are concerning. Very frustrating from a consumer perspective because how the fuck are you supposed to know what is and isn’t hipaa compliant. It’s silly to have to research whether your clinician is using a regulatory compliant platform but here we are, I guess