HIPAA_VIOLATION_APP medical config_error ai_generated true

AI recommends using consumer video apps (Zoom, FaceTime, WhatsApp) for telemedicine consultations without HIPAA compliance

ID: medical/telemedicine-hipaa-violation

Also available as: JSON · Markdown · 中文
93%Fix Rate
89%Confidence
1Evidence
2024-01-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
hipaa_rule_2023 active — — —
zoom_healthcare_5.17 active — — —
doxy.me_2024.1 active — — —

Root Cause

Consumer video platforms do not sign Business Associate Agreements (BAAs) and lack end-to-end encryption required for protected health information (PHI) under HIPAA.

generic

中文

消费者视频平台不签署业务伙伴协议（BAA），且缺乏《健康保险可携性和责任法案》（HIPAA）对受保护健康信息（PHI）要求的端到端加密。

Official Documentation

https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-telehealth/index.html

Workarounds

  1. 95% success Use HIPAA-compliant platforms: Doxy.me, Zoom for Healthcare (with BAA), or Updox. Configure Zoom: sign BAA via settings > HIPAA compliance toggle; enable end-to-end encryption for meetings. 
    Use HIPAA-compliant platforms: Doxy.me, Zoom for Healthcare (with BAA), or Updox. Configure Zoom: sign BAA via settings > HIPAA compliance toggle; enable end-to-end encryption for meetings.
  2. 90% success If using open-source: deploy Jitsi Meet on a HIPAA-compliant server (e.g., AWS with BAA) and configure encryption. Example config: `jitsi-videobridge --domain=telemed.example.com --secure-domain=true --require-encryption=true` 
    If using open-source: deploy Jitsi Meet on a HIPAA-compliant server (e.g., AWS with BAA) and configure encryption. Example config: `jitsi-videobridge --domain=telemed.example.com --secure-domain=true --require-encryption=true`

中文步骤

  1. Use HIPAA-compliant platforms: Doxy.me, Zoom for Healthcare (with BAA), or Updox. Configure Zoom: sign BAA via settings > HIPAA compliance toggle; enable end-to-end encryption for meetings.
  2. If using open-source: deploy Jitsi Meet on a HIPAA-compliant server (e.g., AWS with BAA) and configure encryption. Example config: `jitsi-videobridge --domain=telemed.example.com --secure-domain=true --require-encryption=true`

Dead Ends

Common approaches that don't work:

  1. 75% fail

    User assumes any encrypted app is HIPAA-compliant; encryption alone is insufficient without BAA

  2. 60% fail

    User thinks small practices are exempt from HIPAA for telemedicine