HIPPA Compliance

[Steven Kassakian]

I am curious what others are thinking about how to maintain compliance with Hippa in deploying fhir based apps. 

My application requires phi to do it's analytics.  It doesn't store any phi it only returns results to the user ehr. 

I am curious if my software company will need to be a business associate of each covered entity which uses our software and also we need to develop all the other policies surrounding hipaa. 

Any experience on the topic?

Thanks, Steve

[Andrew Torres]

Steve,

This is a great question! The office for civil rights has provided some guidance on the subject[1][2]. The second link currently is not working, but the first gives a summary of what the link provided in the past. You should consult with this and understand when a BAA is required. I would review this documentation for clarity.

Thanks,

Drew

[1]http://www.healthlawcenterplc.com/hipaa-when-are-mobile-app-developers-business-associates/

[2]http://hipaaqsportal.hhs.gov/community-library/accounts/92/925889/OCR-health-app-developer-scenarios-2-2016.pdf