The Health Insurance Portability and Accountability Act (HIPAA) is a set of federal standards to protect the privacy of patients’ medical records and other health information maintained by covered entities: health plans, which include many governmental health programs, such as the Veterans Health Administration, Medicare, and Medicaid; most doctors, hospitals, and many other health care providers; and healthcare clearinghouses. These standards provide patients with access to their medical records and with significant control over how their personal health information is used and disclosed. The Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities and their business associates to use so they can assure the confidentiality, integrity, and availability of electronic protected health information (PHI).
PHI generally includes individually identifiable health information including demographic data, that relates to:
The individual’s past, present or future physical or mental health or condition,
The provision of health care to the individual, or
The past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.
Individually identifiable health information including name, address, birth date, Social Security Number, etc.
By law, the HIPAA Privacy Rule applies to covered entities: health plans, healthcare clearinghouses, and certain healthcare providers and business associates. A business associate is a person or entity that performs certain functions or activities that involve the use of the PHI on behalf of a covered entity.
Contact Cloud offers a number of features and configurations to allow customers to use our system and maintain HIPAA compliance. The checklist below is meant to serve as a guide of required features for most use cases that can help you maintain compliance with HIPAA while using Contact Cloud and is not a substitute for legal advice. You may need to make additional adjustments in your account based on your particular use case. Find more information on the HIPAA website.
Required Tools and Settings
We need to have a Business Associate Agreement in place with you. Please contact us at [email protected] to request a BAA.
You cannot use tracking numbers that are marked as “not eligible for HIPAA compliance”. Non HIPAA numbers will be marked with an asterisk and flagged on the Buy Numbers page as well as the Tracking Numbers page in your account.
Individual Logins: Each individual user accessing HIPAA accounts must have their own unique login for Contact Cloud.
User Security: Within Account Settings, navigate to “Security” area and configure the following:
o Logout users automatically after no more than 15 minutes of idle connection, o o Enable two factor authentication to ask for verification code every time or every 30 days, and
o Check the box to require a user login to access call recordings.
Encrypted Call Recordings: If recording phone calls, you must enable the following in account settings:
o Encrypted call recordings – Encrypted call recordings cost an additional per minute (see pricing on the website).
o Encrypted call recording storage – Encrypted call recording storage costs additional per minute.
Avoid configuring triggers, notifications, or exports that move PHI out of Contact Cloud into emails or text messages. If choosing to use any of these features, it is your responsibility to ensure security of the information once it leaves Contact Cloud.
o For example, post call notifications trigger emails each time a call comes in that matches certain criteria you have set. The emails often include links to listen to the audio recording for the call. Be sure to remove fields that could contain unsecured PHI from your notifications such as: Recordings (unless the login required option has been turned on per item above), Transcriptions, Name, Phone number, E-mail address, Call Notes, and any other field containing PHI for your particular use case (such as tags).
o When using SMS services on Contact Cloud, you cannot include PHI in the body of your text messages.
o Another example would be exporting your call log. When exporting the call log, you would need to remove any fields that contain unsecured access to PHI such as Recordings (unless the login required option has been turned on per item above), Transcriptions, Name, Phone number, E-mail address, Call Notes, and any other field containing PHI for your particular use case (such as tags).
If using transcriptions, you cannot use “Enhanced” Transcriptions.
If you expect sensitive information such as Social Security numbers or personal phone numbers to be exchanged, you should enable Secure Call Transcriptions which will automatically detect the presence of that information in your interactions and will redact them from your recordings and transcriptions.
Consider turning off Caller ID in Call Settings if you do not need to collect the name or location of your callers.
Avoid using Enhanced Caller ID if you do not need to collect that information.
Enable automatic redaction on your account to manage how much and how long information is being stored.
o Redaction removes personal information from records of calls, texts, and forms in your account.
o Redaction can be configured to occur daily, every 30 days, every 60 days, or every 90 days.
o Redaction can also be done manually for an individual call or text in the Call or Text Log.
MMS enables exchange of attachments and picture messages between mobile phones over the carrier network. This capability cannot be used in conjunction with SMS for workflows requiring HIPAA compliance at this time.
Online Fax allows customers to send and receive faxes on their tracking numbers. This feature cannot be used for workflows requiring HIPAA compliance at this time.
Integrations with Third Parties
Integrations with Third Party services and webhooks and triggers enable customers to link Contact Cloud with external services like Salesforce, Hubspot or Facebook. It is your responsibility to ensure that the third party services or applications are used in a HIPAA compliant manner.
The list above is not meant to be comprehensive or replace the official HIPAA standards and guidelines. As always, we recommend that customers seek guidance from their legal counsel if they have any compliance questions concerning their use of Contact Cloud.