INTRODUCTION: HIPAA MEETS MODERN TECHNOLOGY

When HIPAA was enacted in 1996, the healthcare technology landscape was vastly different:

• Fax machines were cutting-edge
• Email was relatively new
• Cloud computing didn’t exist
• Smartphones weren’t invented yet
• Social media was science fiction
• Telehealth was rare

Today’s Reality:

 

• Nearly 100% of medical records are electronic
• Telehealth visits are routine
• Patients text their doctors
• Health apps track everything
• Cloud-based EHRs are standard
• AI analyzes medical images
• Wearable devices monitor vitals 24/7

The Challenge:

 

HIPAA rules written for a paper-based world now apply to rapidly evolving technology. This module helps you navigate modern healthcare technology while staying HIPAA compliant.

ELECTRONIC HEALTH RECORDS (EHRs)

HIPAA Compliance for EHR Systems:

 

1. Access Controls

 

• Unique user IDs (no shared logins!)
• Strong passwords
• Role-based access (minimum necessary)
• Automatic logoff after inactivity
• Multi-factor authentication

Common Violations:

 

? Shared “admin” or “nurse” logins

? Leaving systems unlocked

? Accessing records without work-related need

? Weak passwords (Password123!)

2.  Audit Controls

 

• Track who accesses which records
• Log all PHI access
• Regular audit log review
• Alert on suspicious patterns
• Maintain logs for 6+ years

What to Monitor:

 

• Celebrity patient access
• Employee/family member records
• Unusual access patterns (off-hours, large volumes)
• Failed login attempts
• Administrative changes

3.  Encryption

 

• Data at rest (on servers, databases)
• Data in transit (over networks)
• Backup encryption

• Use current encryption standards (AES-256)

4.  Integrity Controls

 

• Prevent unauthorized alteration
• Detect unauthorized changes
• Version control
• Audit trails for modifications

5.  Transmission Security

 

• Secure networks
• VPN for remote access
• Encrypted data transfers
• Secure APIs

Best Practices:

 

For Users:

 

• Log out when leaving workstation (even briefly!)
• Position screens away from public view
• Don’t write passwords on sticky notes
• Report suspicious activity
• Only access records you need for your job

For IT/Administrators:

 

• Regular security assessments
• Patch management
• User training
• Access reviews
• Incident response planning

EHR Vendor Selection:

 

When choosing EHR:

• HIPAA Security Rule compliance
• Will sign BAA
• Encryption capabilities

• Audit controls
• Access management features
• Backup and recovery
• Interoperability
• Track record (no major breaches)
• Responsive support
• Certification (ONC-certified)

TELEHEALTH AND VIRTUAL VISITS

 

HIPAA Requirements for Telehealth:

 

1. Platform Selection

 

Must use platforms that:

• Are HIPAA-compliant
• Offer encryption
• Will sign BAA
• Provide security features

HIPAA-Compliant Platforms:

 

• Zoom for Healthcare (NOT regular Zoom)
• me
• SimplePractice
• VSee
• Skype for Business (with BAA)
• Microsoft Teams for Healthcare

NOT HIPAA-Compliant (without proper setup):

 

? Regular Zoom (free/basic)

? FaceTime (Apple won’t sign BAA)

? Facebook Messenger

? WhatsApp

? Regular Skype

? Google Hangouts/Meet (standard)

**Note:** During COVID-19 Public Health Emergency, OCR exercised enforcement discretion for telehealth platforms. Post-PHE, full HIPAA compliance required!

2.  Patient Privacy During Visits Provider Responsibilities:

• Private location for visits
• Ensure no one can overhear
• Verify patient identity
• Check patient’s location privacy

Patient Guidance:

 

Advise patients to:

• Be in private location if possible
• Use headphones for privacy
• Be aware of who might overhear
• Check their background (in video)

3.  Security Measures

 

• Waiting room features
• Password protection
• End-to-end encryption
• Session timeout
• Recording controls (get consent!)

4.  Documentation

 

• Document same as in-person visit
• Note visit was via telehealth
• Document consent for telehealth
• Store in EHR securely

5.  Informed Consent

 

Obtain patient consent for telehealth addressing:

• How it works
• Privacy and security measures
• Limitations of telehealth
• Technology requirements
• Emergency procedures
• How information will be stored

Common Telehealth Mistakes:

 

? Using non-secure platforms

? Recording without consent

? Not verifying patient identity

? Conducting sessions in public areas

? Poor audio/video quality affecting care

? Not documenting properly

? No backup plan for technology failures

EMAIL COMMUNICATION

 

The HIPAA Email Challenge:

 

Standard email is NOT encrypted by default. Sending PHI via unencrypted email is risky.

Options for Email with PHI:

 

1. Encrypted Email Systems

 

• Secure email gateways
• TLS encryption (if recipient supports)
• PGP/S/MIME encryption
• Encrypted portals for message pickup

2.  Patient Portals

 

• Instead of email, use portal messaging
• Portal provides encryption
• Messages stored securely
• Audit trail

3.  Patient Consent/Risk Warning

 

• Can send unencrypted email if patient:
• Requests email communication
• Is warned of risks
• Consents despite risks

Best Practices for Email:

 

**DO:**

 

• Use encrypted email for ePHI
• Verify recipient email addresses
• Use “blind copy” (BCC) for mass emails
• Minimize PHI in emails
• Train staff on email security
• Have email retention policies

**DON’T:**

 

? Send ePHI via unencrypted email without consent

? Use personal email for work

? Forward patient information to unsecure accounts

? Include full medical records in email body

? Send to wrong recipients (check addresses!)

? Use “Reply All” carelessly

Email Signature Reminders:

 

Consider adding confidentiality notice:

“This email may contain confidential and privileged information. If you are not the intended recipient, please notify the sender immediately and delete this email.”

Common Email Violations:

 

Case 1: Wrong Recipient

 

Staff member emails patient records to another patient with similar name.

• Unauthorized disclosure
• Breach requiring notification
• Need better verification procedures

Case 2: Reply All

 

Employee hits “reply all” with patient information, sending to entire department including non-clinical staff.

• Minimum necessary violation
• Training issue
• System controls needed

Case 3: Personal Email

 

Provider forwards patient info to personal Gmail to work from home.

• Security violation
• No encryption
• Personal devices not secured

TEXT MESSAGING

 

The Problem:

 

Standard text messages (SMS) are NOT encrypted and should not contain PHI.

HIPAA Concerns with Texting:

 

• Not encrypted
• Stored on phones
• Phone might be lost/stolen
• Texts might auto-sync to cloud
• Screenshots easily shared
• No audit trail

Solutions:

 

1. Secure Messaging Apps

 

Use HIPAA-compliant apps:

• TigerText
• Spok
• Imprivata Cortext
• Halo Health
• Doc Halo
• Cureatr Features needed:

• Encryption
• Authentication
• Audit logs
• Remote wipe capability
• Message expiration
• Screenshot prevention
• BAA from vendor

2.  Limited Content

 

If using standard SMS:

• Don’t include patient names
• Don’t include specific diagnoses
• Don’t include treatments
• Use general language

OK via Standard SMS:

 

• “Your appointment is tomorrow at 2pm”
• “Your lab results are in – please call to discuss”
• “This is Dr. Smith’s office confirming your visit”

NOT OK via Standard SMS:

 

? “Your HIV test was positive”

? “John Smith, your biopsy showed cancer”

? “Increasing your antidepressant dosage”

3.  De-Identified Information

 

If no patient identifiers, not PHI:

• “Patient in Room 5 needs medication”
• “45yo female in ER with chest pain”

Best Practices:

 

• Use secure messaging apps
• Get patient consent for text reminders
• Minimize PHI in any texts
• Encrypt devices
• Use strong passcodes
• Enable remote wipe
• Training on appropriate vs. inappropriate texting

Common Texting Violations:

 

Violation 1: Group Text

 

Nurse creates group text with patient names and room numbers.

• Unauthorized disclosure
• Multiple recipients may not need info
• Stored on multiple personal devices

Violation 2: Screenshots

 

Doctor screenshots patient info from EHR and texts to colleague.

• Unsecured transmission
• Image stored on both phones
• No encryption

Violation 3: Personal Devices

 

Staff using personal phones to text about patients without secure app or device management.

• Lost/stolen phone risk
• No organizational control
• Commingling personal/work data

SOCIAL MEDIA

 

HIPAA and Social Media – A Dangerous Mix:

 

Absolute Rules:

 

**NEVER:**

 

? Post patient information on social media

? Post patient photos (even if you think faces aren’t visible)

? Discuss patients, even without names

? Share “interesting cases”

? Complain about patients

? Post from work showing patient areas

? Live-stream from clinical areas

Even if You Think It’s Anonymous:

 

Small details can identify patients:

• “A patient came in ..”
• “Had a case ..”
• Geographic information
• Timing details
• Unusual conditions
• Combined details from multiple posts

Real Violations:

 

Case 1: “Anonymous” Post

 

Nurse posted: “So annoying when patients lie about their drug use. Had one today who swore they’re clean but track marks everywhere.”

Problem: Patient recognized themselves from timing and details. Filed complaint. Outcome: Nurse terminated, facility fined.

Case 2: Patient Photo

 

Medical student posted “cool X-ray” on Instagram, thinking it was anonymous.

Problem: Date, medical center name, and rare condition allowed identification. Outcome: Student expelled, facility fined, patient sued.

Case 3: Celebrity Patient

 

Hospital employee posted: “OMG, [celebrity name] is here!”

Problem: Confirmed patient’s location and that they’re receiving medical care. Outcome: Employee fired, hospital fined $1 million+, massive media coverage. Social Media Policy Should Address:

• No PHI on personal social media
• No patient photos
• No discussion of patients
• No posting from clinical areas showing patients
• Consequences of violations
• Reporting process if violations observed
• Organization’s official social media use

Organizational Social Media:

 

If organization uses social media:

• Designate authorized personnel
• Never post patient information without explicit written authorization
• If posting patient stories, get proper authorization
• Vet all content for PHI
• Have review/approval process
• Monitor comments

Employee Personal Social Media:

 

Even on personal time:

• Don’t identify yourself with your employer + discuss patients
• Don’t post photos from work that might include patients
• Remember you’re always representing your profession

• • Think before you post
  • When in doubt, don’t post!

 

MOBILE DEVICES

 

Types of Mobile Devices:

 

• Smartphones
• Tablets
• Laptops
• Wearables
• Portable medical devices
• USB drives
• External hard drives

HIPAA Requirements for Mobile Devices:

 

1. Encryption

 

• All devices with ePHI must be encrypted
• Use device encryption features
• Encrypt removable media
• Full-disk encryption for laptops

2.  Access Controls

 

• Strong passwords/PINs
• Biometric authentication where available
• Automatic lock after inactivity
• Failed login limits

3.  Remote Wipe

 

• Capability to remotely erase data
• Implement mobile device management (MDM)
• Use if device lost/stolen
• Use when employee leaves

4.  Security Features

 

• Anti-malware software
• Firewall
• Operating system updates
• App vetting/approval
• Disable unnecessary features (Bluetooth, )

5.  Physical Security

 

• Don’t leave devices unattended
• Don’t leave in vehicles
• Use cable locks for laptops
• Tracking software (Find My Device)

BYOD (Bring Your Own Device):

 

If allowing personal devices for work:

Must Have:

 

• Written BYOD policy
• Device enrollment in MDM
• Security requirements
• Acceptable use agreement
• Remote wipe authorization
• Separation of work/personal data
• User training

Should Address:

 

• What devices are allowed
• Security requirements
• Support/IT assistance
• What happens if device lost
• What happens when employee leaves
• Who owns data on device
• Reimbursement (if any)

Best Practices:

 

• Prefer organization-owned devices
• Containerization for BYOD (separates work/personal)
• Regular security assessments
• User training
• Incident response plan for lost devices

Lost/Stolen Device Protocol:

 

1. Report immediately to IT/Security

2. Document what data was on device

3. Initiate remote wipe if possible

4. Change passwords for accounts on device

5. Conduct breach risk assessment

6. Notify affected individuals if breach

7. Report to law enforcement

8. Document everything

CLOUD COMPUTING

 

Cloud Service Models:

 

SaaS (Software as a Service):

 

• EHR systems
• Practice management software
• Email services
• Examples: Cloud-based EHR, Office 365

PaaS (Platform as a Service):

 

• Development platforms
• Database services
• Examples: Azure, Google Cloud Platform

IaaS (Infrastructure as a Service):

 

• Virtual servers
• Storage
• Networking
• Examples: AWS, Azure VMs

HIPAA Requirements:

 

1. Business Associate Agreement

 

Cloud provider is almost always a BA if they can access ePHI.

2.  Due Diligence

 

Before using cloud service:

• Verify HIPAA compliance
• Review security measures
• Check certifications (HITRUST, SOC 2)
• Understand data location
• Identify subcontractors

3.  Configuration

 

Your responsibility:

• Enable encryption
• Configure access controls
• Implement monitoring
• Manage user permissions
• Enable audit logging
• Configure backups

4.  Shared Responsibility

 

• Cloud provider: Infrastructure security
• You: Configuration, access management, data classification

Cloud-Specific Concerns: Data Location:

• Where is data stored?

• What country/jurisdiction?
• Where are backups?
• Can you control location?

Data Portability:

 

• Can you get your data back?
• What format?
• How long does it take?
• What happens if vendor goes out of business?

Access:

 

• Who at cloud provider can access your data?
• What are access controls?
• How is access monitored?
• Background checks for provider’s employees?

Incident Response:

 

• How will you know if breach occurs?
• What’s provider’s incident response?
• How will they notify you?
• What support will they provide?

Major Cloud Providers:

 

AWS, Microsoft Azure, Google Cloud:

 

• Will sign BAAs
• Have HIPAA-compliant services
• You must configure properly
• Not all services are HIPAA-compliant
• Know which services you can use

Best Practices:

 

• Know your data location
• Encrypt everything
• Use MFA

• Regular access reviews
• Monitor logs
• Have exit strategy
• Test backup restoration
• Review vendor security regularly

PATIENT PORTALS AND HEALTH APPS

 

Patient Portals:

 

HIPAA Compliance:

 

• Encryption (in transit and at rest)
• Strong authentication
• Audit logs
• Session timeout
• User education
• BAA with vendor

Security Features:

 

• Unique user IDs
• Strong password requirements
• Multi-factor authentication
• Security questions
• Automatic logout
• Encryption

Patient Education:

 

Teach patients to:

• Create strong passwords
• Don’t share login credentials
• Log out when finished
• Use secure connections (not public Wi-Fi)
• Be cautious about proxy access

• Report suspicious activity

Proxy Access:

 

Allow caregivers to access on patient’s behalf:

• Verify authority (parent, guardian, personal representative)
• Document authorization
• Separate login credentials
• Ability to revoke access
• Audit proxy access

Common Portal Features:

 

• View medical records
• Lab results
• Medication lists
• Appointment scheduling
• Secure messaging
• Bill payment
• Educational resources

Third-Party Health Apps:

 

Categories:

 

1. Apps You Provide/Recommend:

 

• If you’re providing access to PHI through app: You’re covered entity
• App developer: Business associate
• Need BAA with developer

2.  Patient-Selected Apps:

 

• Patient chooses to use app
• Patient directs you to send data to app
• If properly authorized: Not a disclosure requiring your oversight
• You’re fulfilling patient’s access right

Patient-Generated Health Data:

 

Patients may bring you data from:

• Fitness trackers
• Blood pressure monitors
• Glucose monitors
• Sleep trackers
• Symptom diaries

Your Responsibilities:

 

• Determine if you’ll incorporate into medical record
• If yes, becomes part of PHI
• Document source
• Note limitations/reliability
• Clinical judgment on how to use

EMERGING TECHNOLOGIES

 

Artificial Intelligence/Machine Learning:

 

• AI analyzing medical images
• Predictive analytics
• Clinical decision support

HIPAA Considerations:

 

• AI vendor is likely business associate
• Training data must be de-identified or authorized
• Bias and accuracy concerns
• Transparency to patients
• Human oversight

Internet of Things (IoT):

 

• Connected medical devices
• Remote monitoring devices
• Smart hospital rooms

HIPAA Considerations:

 

• Device security
• Network security
• Data transmission encryption
• Manufacturer as potential BA
• Patch management

Blockchain:

 

• Emerging use for health records
• Promises security and interoperability

HIPAA Considerations:

 

• Immutability vs. right to amend
• Right to delete vs. permanent ledger
• Access controls
• Privacy in distributed system

Wearable Devices:

 

• Smart watches
• Continuous glucose monitors
• Heart rhythm monitors

HIPAA Considerations:

 

• Consumer devices vs. medical devices
• Patient-generated vs. provider-generated data
• Integration with EHR
• Data accuracy and reliability

INCIDENT RESPONSE FOR TECHNOLOGY ISSUES

 

Common Technology Incidents:

 

1. Ransomware attack

2. Phishing leading to compromise

3. Lost/stolen device

4. Unauthorized access

5. Email to wrong recipient

6. System misconfiguration exposing data

7. Vendor breach

8. Insider theft of data

Immediate Response Steps:

 

1. Contain (First Hour):

 

• Disconnect affected systems
• Disable compromised accounts
• Prevent further damage
• Preserve evidence

2.  Assess (First 24 Hours):

 

• What happened?
• What data affected?
• How many individuals?
• How did it occur?

3.  Notify (As Required):

 

• Privacy Officer
• Security Officer
• Management
• Legal counsel
• Law enforcement (if criminal)
• Affected individuals (if breach)
• HHS (if breach)

4.  Remediate:

 

• Fix vulnerability
• Implement additional controls
• Update policies

• Additional training

5.  Document:

 

• Timeline of events
• Actions taken
• Decisions made
• Lessons learned

TRAINING AND AWARENESS

 

Technology Training Should Cover: For All Staff:

• Email security
• Password management
• Recognizing phishing
• Social media risks
• Mobile device security
• Acceptable use of technology
• Reporting security incidents

For Clinical Staff:

 

• EHR security
• Telehealth compliance
• Patient portal management
• Mobile clinical apps
• Texting guidelines

For IT Staff:

 

• Security Rule requirements
• Configuration management
• Access controls
• Audit log monitoring
• Incident response

• Vendor management

Ongoing Awareness:

 

• Regular security reminders
• Simulated phishing tests
• Updates on new threats
• Technology changes
• Policy updates

KEY TAKEAWAYS

 

• Technology has transformed healthcare but HIPAA still applies
• EHR systems require strong access controls, audit logs, and encryption
• Telehealth platforms must be HIPAA-compliant with proper BAAs
• Email containing PHI should be encrypted; obtain patient consent if using unencrypted
• Standard text messages (SMS) should not contain PHI
• Social media and PHI never mix – even “anonymous” posts can identify patients
• All mobile devices with ePHI must be encrypted with strong access controls
• Cloud providers are typically business associates requiring BAAs
• Patient portals must have robust security and patient education
• Emerging technologies (AI, IoT, blockchain) pose new HIPAA challenges