Note This law applies to U.S. customers only. Customers should rely on appropriate legal counsel and outside auditors for interpretation of the requirements of the act. Suggestions in this document are not to be construed as a substitute for legal advice or a definitive list of all possible legal considerations.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires health care providers to disclose to health care recipients the ways in which the institution may use and disclose private information. HIPAA also requires health care providers to protect the privacy of certain individually identifiable health data for health care recipients.
Messaging data to which HIPAA might apply includes customer names and telephone numbers, and called and calling number data.
Use of the following key features can protect patient privacy and demonstrate compliance of the health care provider with HIPAA.
| Feature | How related to HIPAA | Where documented |
|---|---|---|
| Encryption | Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate | |
| System access control | Implement technical policies and procedures for electronic information systems that maintain electronically-protected health information to allow access only to those persons or software programs that have been granted access rights. | |
| Authentication | Implement procedures to verify that a person or entity seeking access to electronically-protected health information is the one claimed. | |
| Backup of data | Establish and implement policies and procedures for responding to an emergency or other occurrence such as fire, vandalism, system failure, and natural disaster that damages systems containing electronically-protected health information. |