1

We are developing software and interested in the following matter: Is having email addresses and usernames of our users in file logs a HIPAA violation or not?

NOTE:
1. We are not going to store passwords in the log files just usernames and email addresses.
2. These file logs are used internally only.

I don't see any issue in accordance to this list https://www.hipaajournal.com/hipaa-compliance-checklist/ however it would be better to know for sure.

Thank you.

Improve this question
3
  • 1
    Ask your company's legal department or a HIPAA consulting firm.
    – BlueDogRanch
    Commented Nov 5, 2019 at 15:37
  • Law SE provides suggestions, your attorney provides the best certainty that money can buy.
    – user6726
    Commented Nov 5, 2019 at 15:58
  • Hello! Welcome to Law.SE. Please read our tour page.
    – isakbob
    Commented Nov 5, 2019 at 18:50

1 Answer 1

Reset to default
1

Technically, HIPPA regulates the ways in which health information is disseminated, not the ways in which it is used only by the doctor and his staff as long as it's not transmitted.

Therefore it would not cover the logs if they are only accessible to the doctor and his staff. However, just as a smart way of doing things, you should use encryption, whether the law tells you to or not. Treat people's data the right way, no matter what the law says. https://www.hipaajournal.com/hipaa-encryption-requirements/

Improve this answer
1
  • Disseminated is what I was trying to say.
    – Putvi
    Commented Nov 6, 2019 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .