Over the past few years, and particularly during the COVID-19 pandemic, the Department of Health and Human Services Office for Civil Rights in Action (OCR) has made countless efforts to enhance its Health Insurance Portability and Accountability Act (HIPAA) guidance and other related resources on its website. Last week, the OCR launched a new feature on their website HHS.gov, entitled Health Apps, which updates and renames the OCR’s previous Health App Developer Portal, and is available here.
The new site features the OCR’s helpful guidance on “when and how” HIPAA regulations may be applicable to mobile health applications, acutely relevant during the COVID-19 pandemic as many aspects of the healthcare industry shift to telehealth.
Here are the key features of the OCR’s new Health Apps:
- Mobile Health Apps Interactive Tool
- The Federal Trade Commission (FTC), in conjunction with OCR, the HHS Office of National Coordinator for Health Information Technology (ONC), and the Food and Drug Administration (FDA), created a web-based tool to help developers of health-related mobile apps understand what federal laws and regulations might apply to them.
- Health App Use Scenarios & HIPAA
- Provides various use scenarios for mHealth applications, and explains when an app developer may be acting as a business associate under the HIPAA Rules.
- FAQs on the HIPAA Right of Access, Apps & APIs
- Provides helpful insight on how the HIPAA Rules apply to covered entities and their business associates with respect to the right of access, apps, and application programming interface (APIs).
- FAQs on HIPAA & Health Information Technology
- Provides helpful insight on the relationship between HIPAA and Health IT.
- Guidance on HIPAA & Cloud Computing
- Assistance for HIPAA covered entities and business associates, including cloud service providers, in how to effectively utilize cloud computing while still maintain HIPAA compliance.
As telehealth has increasingly become the norm, and the US continues to implement and consider various forms of contact tracing apps, patient privacy and maintaining HIPAA privacy and security obligations has never been more important. The increased use of mobile health applications and other related tools to assist healthcare providers with facilitation of telehealth capabilities, also comes with an increased risk of data breaches and improper disclosures of protected health information (PHI) to unauthorized individuals. The features of OCR’s new Health apps are a great starting point for HIPAA covered entities and businesses associates that utilize mobile health apps, and want to ensure compliance with their HIPAA obligations.
Below are some of our additional resources on OCR HIPAA related initiatives of late:
- OCR is Serious About Patients’ Rights to Access Records, Announcing Enforcement Actions Against 5 Providers
- HIPAA Covered Entities and Business Associates Need an IT Asset Inventory List, OCR Recommends
- OCR Warns HIPAA Covered Entities: When You Learn About HIPAA Violations, Fix Them
- Beware, Persons Posing as OCR Investigators Demand PHI, Says OCR Alert
- More OCR Guidance on COVID-19 and HIPAA Relief – Business Associates
- OCR HIPAA Guidance For Getting PHI of COVID-19 Exposed Individuals to First Responders