First Healthcare Compliance CONNECT September 2019

Q&A: HIPAA and Health Apps By Catherine Short
Rachel V. Rose, JD, MBA, presented the
webinar “HIPAA and Health Apps.” Rachel
returned to answer many commonly
asked questions on our blog.
How has HIPAA evolved to address mobile
technology?
HIPAA was signed into law in August 1996. Subsequently,
the Privacy Rule and Security Rule were implemented.
In 2009, the HITECH Act passed and with it came an
increased focus on security of protected health information
(PHI) and breach notification. Finally, on January 25, 2013,
the Final Omnibus Rule was published (78 Fed. Reg. 5566
(Jan. 25, 2013)). In general, the U.S. Department of Health
and Human Services – Office for Civil Rights has primary
jurisdiction over HIPAA enforcement for covered entities,
business associates and subcontractors. Other agencies
such as the Federal Trade Commission (FTC) and the Food
and Drug Administration (FDA) also play a role.
In terms of mobile technology and health apps in particular,
HHS recently published FAQs – a series of five questions
and answers that target a covered entity’s liability when
transferring a patient’s data to an app. Additionally, over the
past couple of years, the FDA has released guidance on
mobile medical apps – specifically those medical apps the
8
FDA will regulate and those that it won’t, which depends on
the app’s function.
What is covered under ePHI?
ePHI, which is also known as electronic protected health
information, is protected health information that is
produced, saved, transferred or received in an electronic
form. This can include USB drives, CD-ROMS, email, apps
and VoIP technology. The management of ePHI is covered
under the Security Rule.
What steps can companies take to ensure
compliance?
One can think of compliance as an inverted triangle –
start with a broad base at the top and narrow the focus
into different departments and the relevant technical,
administrative and physical safeguards set forth in the
Security Rule. The top should include forming an enterprise
risk management team and conducting an annual,
comprehensive risk analysis that every team member
reads. From there, understanding the ingress and egress
of protected health information, the vulnerabilities and
compliance solutions identified in the risk analysis can be
addressed.
First Healthcare Compliance, LLC © 2019