HIPAA compliant document sharing, for a small firm that handles covered health information for a client, is mostly a question of what the software can prove: that the file was sent through a channel that encrypts it in transit and at rest, that every access to it was logged with who and when, that the firm can export that record, and that the vendor will sign the agreement the rule requires. Whether a given document is covered, and what the firm's own obligations are, is the adviser's judgement and this page does not give it. What the page does say is what to require of the software before a covered file goes through it. The free document capture worksheet on this site sizes the intake; Batesio Pro logs every access and export.
Encrypted in transit and at rest, and say so in writing
The portal should state, in its terms, that files are encrypted on the way and where they are stored, and the firm should keep that statement with its own compliance file. A vendor that cannot say so in writing has answered the question.
Every access logged, and the log exportable
Who opened the file, when, and from where, kept against the document and exportable on request, is the record a covered-entity client or its auditor will ask the firm for. Email produces no such log; a general drive, at Dropbox's $15 per user per month for its Standard team plan cited below, produces one only where the firm has configured it.
The agreement, and the adviser
The rule requires an agreement with the vendor handling covered information; whether the firm needs one, and what it must say, is the adviser's to confirm. The software's part is to sign one and to keep the log that makes it meaningful. Batesio Pro logs access and export on every document; the legal position is named on the terms as the adviser's.
Questions people ask about hipaa compliant document sharing
Is a document portal enough for HIPAA compliance?
The portal supplies the channel and the log; compliance is the firm's programme and the adviser's judgement. Require the encryption statement, the access log and the agreement, then ask the adviser.
Can we share covered files by email if they are encrypted?
That is a question for the adviser. The portal's advantage is the log of every access, which encrypted email does not keep.
q
a