We are developing software and interested in the following matter: Is having email addresses and usernames of our users in file logs a HIPAA violation or not?

1. We are not going to store passwords in the log files just usernames and email addresses.
2. These file logs are used internally only.

I don't see any issue in accordance to this list https://www.hipaajournal.com/hipaa-compliance-checklist/ however it would be better to know for sure.

Thank you.

  • 1
    Ask your company's legal department or a HIPAA consulting firm. Nov 5, 2019 at 15:37
  • Law SE provides suggestions, your attorney provides the best certainty that money can buy.
    – user6726
    Nov 5, 2019 at 15:58
  • Hello! Welcome to Law.SE. Please read our tour page.
    – isakbob
    Nov 5, 2019 at 18:50

1 Answer 1


Technically, HIPPA regulates the ways in which health information is disseminated, not the ways in which it is used only by the doctor and his staff as long as it's not transmitted.

Therefore it would not cover the logs if they are only accessible to the doctor and his staff. However, just as a smart way of doing things, you should use encryption, whether the law tells you to or not. Treat people's data the right way, no matter what the law says. https://www.hipaajournal.com/hipaa-encryption-requirements/

  • Disseminated is what I was trying to say.
    – Putvi
    Nov 6, 2019 at 19:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.