{"id":2244,"date":"2020-12-29T03:38:30","date_gmt":"2020-12-29T03:38:30","guid":{"rendered":"https:\/\/o3b.com\/medtunnel\/?page_id=2244"},"modified":"2020-12-29T17:14:48","modified_gmt":"2020-12-29T17:14:48","slug":"hipaa-compliance","status":"publish","type":"page","link":"https:\/\/medtunnel.com\/hipaa-compliance\/","title":{"rendered":"HIPAA Compliance"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

Why are Email and Text Messaging Not HIPAA compliant?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Many people falsely believe that traditional email and texting of private health information is HIPAA compliant.\u00a0 This is simply not true and anyone who is currently using these methods is putting their organization at risk.<\/p>

HIPAA regulations require that all private health information (PHI) remain private and be only accessible by authorized personnel.\u00a0 This means that when transmitting PHI two things have to be ensured.\u00a0 First the PHI needs to be encrypted when being transmitted.\u00a0 This ensures that PHI remains private even when transmitted over a public network like the Internet.\u00a0 Second, PHI should only be viewable by the intended recipient and not by any entity that is being used to transport that information.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

A good example of a HIPAA compliant method for delivering PHI is the US Postal Service (snail mail).\u00a0 When a doctor mails a letter containing PHI to a patient both criteria are met.\u00a0 Since the letter is in a sealed envelope and the seal will only be broken by the recipient, then no one along the transport path has access to the PHI including the postal service itself.<\/p>

With these criteria in mind lets see why texting and email are not HIPAA complaint.\u00a0 When an email is sent lets see what is actually happening.\u00a0 Lets suppose a physician who has and email address like drjones@communityhospital.com<\/a> sends an email to a patient whose email address is janedoe@gmail.com<\/a>.\u00a0 What happens here is that there are two email servers involved with the transmission of this email, one at community hospital and one at gmail.\u00a0 When Dr. Jones sends the email, his email client on his computer or smart phone connects with his email server at community hospital and transmits the email message to the community hospital server.\u00a0 Next the community hospital server finds where the gmail server is located on the Internet and then transmits the email to the gmail server using a standard protocol called simple mail transfer protocol (SMTP).\u00a0 SMTP is the protocol used to transmit information between email servers over the Internet and it is not encrypted.\u00a0 This is a why message sent via email are not secure and therefore not HIPAA compliant.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The analogy to this would be like mailing a letter without using an envelope.\u00a0 Anyone handling the letter could read the content of the letter.<\/p>

What happens if someone at community hospital sends an email to someone else at community hospital?\u00a0 Is that HIPAA compliant?\u00a0 This depends on the setup of the community hospital mail server.\u00a0 If the server only accepts encrypted connections and never accepts connections from its clients that are not encrypted, then this transmission may be HIPAA compliant since the community hospital email server does not have to communicate with an outside server and the communication is only internal.\u00a0 Even in this situation, it is important to note that for anyone with a communityhospital.com email account, any communication coming from or going to an outside server (i.e. anyone without a communityhospital.com email address) is not HIPAA compliant.<\/p>

What about texting?\u00a0 Is texting HIPAA compliant?\u00a0 First, we need to know that there two types of text messages.\u00a0 The first is simple message service or SMS messages.\u00a0 These messages are handled by cell phone carriers.\u00a0 These messages are not encrypted in transport and can also be read by personnel at the carriers themselves and are therefore not HIPAA compliant.\u00a0 The second type of text message is sent via a text message service like Apple\u2019s iMessage.\u00a0 A service like iMessage does encrypt the message in transport, but this information is not handled in a HIPAA compliant manner by Apple which runs the servers for iMessage.\u00a0 It is for this reason that Apple clearly states that iMessage is not HIPAA compliant.<\/span><\/p>

But email and texting are a very convenient method of communication.\u00a0 It is for this reason that many providers even knowing that these methods are not HIPAA compliant still use these methods clandestinely.\u00a0 But with MedTunnel which is a free service that works like email or texting, but is also HIPAA compliant, this is no longer necessary.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

How is MedTunnel HIPAA compliant?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

The main purpose of MedTunnel is to provide a free, HIPAA compliant, and secure service for transmitting private health information (PHI) through the Internet. The core architecture of our product was designed to meet HIPAA and security guidelines. MedTunnel provides a secure conduit through the Internet for PHI transmission. In fact, our security protocol is such that no one at MedTunnel, even at the CEO level can access PHI even if they wanted to.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t

Since MedTunnel acts only a secure conduit for PHI transmission and MedTunnel does not have access to any PHI and does not permanently store any PHI, a HIPAA Business Associate Agreement is not required in order to use MedTunnel. For more detailed information regarding our security protocol and HIPAA regulations compliance, please see below.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

MedTunnel HIPAA compliant secure transmission protocol<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t

Client transmission to server – when someone sends a message<\/strong><\/p>

  1. Client app with PHI (Protected Health Information) establishes a SSL (https using TCP port 443) connection to the MedTunnel server.<\/li>
  2. PHI is transmitted securely to cloud server using 2048-bit SSL encryption.<\/li>
  3. The cloud server, immediately upon receipt of PHI, encrypts PHI using AES encryption utilizing 3 separate encryption keys: server generated key, MedTunnel key, and Independent Third Party key.
    • a.<\/strong> All 3 keys are required to encrypt and decrypt any PHI data.<\/li>
    • b.<\/strong> The server generated key is randomly generated by the server for each message transmitted via MedTunnel so therefore is unique for each message. This prevents brute-force attacks on the data.<\/li>
    • c.<\/strong> The MedTunnel key is only known by MedTunnel personnel and not known by the Independent Third Party.<\/li>
    • d.<\/strong> The Independent Third Party key is only known by an Independent Third Party and not known by MedTunnel.<\/li>
    • e.<\/strong> Neither MedTunnel or Third Party have access to PHI since all 3 keys are required to unencrypt PHI and therefore, MedTunnel only acts as a secure conduit for PHI transmission and is not subject to needing a HIPAA Business Associate Agreement.<\/li><\/ul><\/li>
    • After encryption, the encrypted PHI is stored on the MedTunnel cloud storage. Only encrypted data is stored and no unencrypted data is stored.<\/li>
    • The data is not stored permanently, but is automatically deleted from the cloud storage after 14 days.<\/li><\/ol>

      Server transmission to client – when someone retrieves a sent message<\/strong><\/p>

      1. Client app requesting PHI establishes an SSL (https) connection to the MedTunnel cloud server.<\/li>
      2. MedTunnel cloud server retrieves the encrypted message data from the MedTunnel cloud storage and unencrypts it utilizing the 3 required keys.<\/li>
      3. The PHI is then transmitted to the client app utilizing 2048-bit SSL encryption via https.<\/li><\/ol>

        Only the sending and receiving client\u00a0applications have access to PHI. \u00a0MedTunnel and the Independent Third Party can not access PHI.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

        \n\t\t\t\t\t\t
        \n\t\t\t\t\t
        \n\t\t\t
        \n\t\t\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t

        MedTunnel HIPAA Compliance Matrix<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n
        Administrative Safeguards<\/th>\n Implementation\n Specification\n (R) = Required (A) =\n Addressable<\/th>\n Description<\/th>\n MedTunnel FulFillment<\/th>\n <\/tr>\n
        Security
        \n Management
        \n Process
        \n 164.308(a)(1)<\/td>\n         		Risk analysis (R)<\/td>\n Conduct an accurate and thorough\n assessment of the potential risks and\n vulnerabilities to the confidentiality,\n integrity, and availability of electronic\n protected health information held by the\n covered entity.<\/td>\n MedTunnel\u2019s applications are designed\n to protect private health information\n (PHI).
        \n
        \n We continuously review our internal\n and external security protocols and\n procedures.<\/td>\n <\/tr>\n
         <\/td>\n Risk management (R)<\/td>\n Implement security measures sufficient to\n reduce risks and vulnerabilities to a\n reasonable and appropriate level to comply\n with \u00a7 164.306(a).<\/td>\n MedTunnel\u2019s applications are built\n around security. We continuously\n implement the latest security measures\n specifically to protect patient data.<\/td>\n <\/tr>\n
         <\/td>\n Sanction policy (R)<\/td>\n Apply appropriate sanctions against\n workforce members who fail to comply\n with the security policies and procedures\n of the covered entity.<\/td>\n MedTunnel’s infrastructure is such that\n no workforce member even at the CEO\n level can inadvertently or on with intent\n access any patient data.<\/td>\n <\/tr>\n
         <\/td>\n Information system\n activity review (R)<\/td>\n Implement procedures to regularly review\n records of information system activity, such\n as audit logs, access reports, and security\n incident tracking reports.<\/td>\n MedTunnel monitors the general\n activity on its servers and it has\n designed a detailed audit and logging\n report for its customers.<\/td>\n <\/tr>\n
        Assigned Security
        \n Responsibility
        \n 164.308(a)(2)<\/td>\n         		Security Official (R)<\/td>\n Identify the security official who is\n responsible for the development and\n implementation of the policies and\n procedures required by this subpart for the\n entity.<\/td>\n Kishore Tipirneni MD, our CEO, is also\n in charge of security and has\n designed and implement many other\n HIPAA compliant software\n applications that are used throughout\n the medical industry on a daily basis.<\/td>\n <\/tr>\n
        Workforce security\n 164.308(a)(3)<\/td>\n Authorization and\/or\n supervision (A)<\/td>\n Implement procedures for the\n authorization and\/or supervision of\n workforce members who work with\n electronic protected health information or\n in locations where it might be accessed.<\/td>\n MedTunnel’s infrastructure is such that\n no workforce member even at the CEO\n level can inadvertently or on with intent\n access any patient data.<\/td>\n <\/tr>\n
         <\/td>\n Workforce clearance\n procedure (A)<\/td>\n Implement procedures to determine that\n the access of a workforce member to\n electronic protected health information is\n appropriate.<\/td>\n MedTunnel’s infrastructure is such that\n no workforce member even at the CEO\n level can inadvertently or on with intent\n access any patient data.<\/td>\n <\/tr>\n
         <\/td>\n Termination procedure\n (A)<\/td>\n Implement procedures for terminating\n access to electronic protected health\n information when the employment of a\n workforce member ends or as required by\n determinations made as specified in\n paragraph (a)(3) (ii)(B) of this section.<\/td>\n Since no MedTunnel employee can\n access PHI, there is no need to\n terminate access upon the end of\n employment of a workforce member.<\/td>\n <\/tr>\n
        Information\n access\n management\n 164.308(a)(4)<\/td>\n Isolating healthcare\n clearinghouse function\n (R)<\/td>\n If a healthcare clearinghouse is part of a\n larger organization, the clearinghouse must\n implement policies and procedures that\n protect the electronic protected health\n information of the clearing- house from\n unauthorized access by the larger\n organization.<\/td>\n MedTunnel has no clearinghouse\n functions.<\/td>\n <\/tr>\n
         <\/td>\n Access authorization (A)<\/td>\n Implement policies and procedures for\n granting access to electronic protected\n health information, for example, through\n access to a workstation, transaction,\n program, process, or other mechanism.<\/td>\n As MedTunnel does not permanently\n store PHI, the control of this function is\n at the level of the administrator for that\n account or group.<\/td>\n <\/tr>\n
         <\/td>\n Access establishment and\n modification (A)<\/td>\n Implement policies and procedures that, based\n upon the entity\u2019s access authorization policies,\n establish, document, review, and modify a\n user\u2019s right of access to a workstation,\n transaction, program, or process.<\/td>\n As MedTunnel does not permanently store\n PHI, the control of this function is at the\n level of the administrator for that account or\n group.<\/td>\n <\/tr>\n
        Security awareness and\n training\n 164.308(a)(5)<\/td>\n Security reminders (A)<\/td>\n Procedures for guarding against, detecting, and\n reporting malicious software.<\/td>\n At MedTunnel, we are intently focused on\n security and implement new security\n features on a regular basis.<\/td>\n <\/tr>\n
         <\/td>\n Protection from malicious\n software (A)<\/td>\n Procedures for guarding against, detecting, and\n reporting malicious software.<\/td>\n As MedTunnel only provides secure\n messaging applications, there is no threat of\n any malicious software or viruses affecting\n our closed system.<\/td>\n <\/tr>\n
         <\/td>\n Log-in monitoring (A)<\/td>\n Procedures for monitoring log-in attempts and\n reporting discrepancies.<\/td>\n At MedTunnel, we provide the tools so\n that the administrator for an account or\n group can set this policy.<\/td>\n <\/tr>\n
         <\/td>\n Password management (A)<\/td>\n Procedures for creating, changing, and\n safeguarding passwords.<\/td>\n At MedTunnel, we provide the tools so\n that the administrator for that account or\n group can set this policy.<\/td>\n <\/tr>\n
        Security incident\n procedures\n 164.308(a)(6)<\/td>\n Response and reporting\n (R)<\/td>\n Identify and respond to suspected or known\n security incidents; mitigate, to the extent\n practicable, harmful effects of security incidents\n that are known to the covered entity; and\n document security incidents and their outcomes.<\/td>\n At MedTunnel, security is our primary\n focus and expertise. We have implemented\n a distributed solution that virtually\n eliminates risk of a potential breach while\n minimizing its impact. If there were to be a\n breach, appropriate reports would be made.<\/td>\n <\/tr>\n
        Contingency plan\n 164.308(a)(7)<\/td>\n Data back-up plan (R)<\/td>\n Establish and implement procedures to create\n and maintain retrievable exact copies of\n electronic protected health information.<\/td>\n Since MedTunnel does not permanently\n store PHI and only acts as a secure conduit\n for PHI, all data should be backed up by the\n sender of the data.<\/td>\n <\/tr>\n
         <\/td>\n Disaster recovery plan (R)<\/td>\n Establish (and implement as needed) procedures\n to restore any loss of data.<\/td>\n Since MedTunnel does not permanently\n store PHI and only acts as a secure conduit\n for PHI, all data should be backed up by the\n sender of the data and the sender should\n have procedures to restore any loss of data.<\/td>\n <\/tr>\n
         <\/td>\n Emergency mode\n operation plan (R)<\/td>\n Establish (and implement\n as needed) procedures to enable the\n continuation of critical business processes\n for protection of the security of electronic\n protected health information while\n operating in emergency mode.<\/td>\n As all data that passes through our\n MedTunnel servers is secure, we do not\n need to make any operational changes\n for an emergency.<\/td>\n <\/tr>\n
         <\/td>\n Testing and revision\n procedure (A)<\/td>\n Implement procedures for periodic testing\n and revision of contingency plans.<\/td>\n MedTunnel has a continuous process to\n improve the availability of our service.<\/td>\n <\/tr>\n
         <\/td>\n Applications and data\n criticality analysis (A)<\/td>\n Assess the relative criticality of specific\n applications and data in support of other\n contingency plan components.<\/td>\n MedTunnel provides secure messaging\n applications. We constantly assess\n various components of the system and\n make contingency plans.<\/td>\n <\/tr>\n
        Evaluation\n 164.308(a)(8)<\/td>\n Technical and nontechnical\n evaluation (R)<\/td>\n Perform a periodic technical and nontechnical\n evaluation, based initially upon\n the standards implemented under this rule\n and subsequently, in response to\n environmental or operational changes\n affecting the security of electronic\n protected health information, that\n establishes the extent to which an entity\u2019s\n security policies and procedures meet the\n requirements of this subpart.<\/td>\n At MedTunnel, security is our primary\n focus and expertise. We are constantly\n evaluating all security procedures.<\/td>\n <\/tr>\n
        Business associate\n contracts and\n other arrangements\n 164.308(b)(1)<\/td>\n Written contract or\n other arrangement (R)<\/td>\n Document the satisfactory assurances\n required by paragraph (b)(1) of this\n section through a written contract or other\n arrangement with the business associate\n that meets the applicable requirements of\n \u00a7 164.314(a).<\/td>\n As MedTunnel is strictly a conduit and\n we do not even access the information\n that passes through our servers on a\n random or infrequent basis, we do not\n even meet the minimum requirements\n (as noted in the Federal Register, Vol.\n 75, No. 134, p. 40873) to be considered\n a Business Associate.<\/td>\n <\/tr>\n
        Facility access\n controls\n 164.310(a)(1)<\/td>\n Contingency operations\n (A)<\/td>\n Establish (and implement as needed)\n procedures that allow facility access\n in support of restoration of lost data\n under the disaster recovery plan and\n emergency mode operations plan in the\n event of an emergency.<\/td>\n At MedTunnel, our cloud servers are\n under an SSAE-16 Compliant cloud\n service provider.<\/td>\n <\/tr>\n
         <\/td>\n Facility security plan\n (A)<\/td>\n Implement policies and procedures\n to safeguard the facility and the\n equipment therein from unauthorized\n physical access, tampering, and theft.<\/td>\n MedTunnel does not keep or store PHI\n in our office. All data is securely routed\n and passes directly through our SSAE-\n 16 Compliant cloud servers.<\/td>\n <\/tr>\n
         <\/td>\n Access control and\n validation procedures\n (A)<\/td>\n Implement procedures to control and\n validate a person’s access to facilities\n based on their role or function, including\n visitor control, and control of access to\n software programs for testing and\n revision.<\/td>\n Since there are no paper or digital PHI\n records stored in the MedTunnel office,\n we do not need to enforce these\n stringent policies; front desk based\n controls are implemented. Data Center\n access controls follow SSAE-16\n standards and procedures as well as\n industry best practices.<\/td>\n <\/tr>\n
         <\/td>\n Maintenance records\n (A)<\/td>\n Implement policies and procedures to\n document repairs and modifications to\n the physical components of a facility,\n which are related to security (for\n example, hardware, walls, doors, and\n locks).<\/td>\n Since there are no paper or digital PHI\n records stored in the MedTunnel office,\n this standard does not apply to us.<\/td>\n <\/tr>\n
        Workstation use\n 164.310(b)<\/td>\n Function and attributes\n (R)<\/td>\n Implement policies and procedures that\n specify the proper functions to be\n performed, the manner in which those\n functions are to be performed, and the\n physical attributes of the surroundings of\n a specific workstation or class of\n workstation that can access electronic\n protected health information.<\/td>\n At MedTunnel, we only provide the\n application and not the hardware so this\n standard does not apply to us.<\/td>\n <\/tr>\n
        Workstation security\n 164.310(c)<\/td>\n Restrict access (R)<\/td>\n Implement physical safeguards for all\n workstations that access electronic\n protected health information, to restrict\n access to authorized users.<\/td>\n At MedTunnel, we provide the tools so\n that the administrator for that account or\n group can implement appropriate\n password protection and automatic\n system logoff.<\/td>\n <\/tr>\n
        Device and media\n controls\n 164.310(d)(1)<\/td>\n Disposal (R)<\/td>\n Implement policies and procedures to\n address the final disposition of electronic\n protected health information, and\/or the\n hardware or electronic media on which it\n is stored.<\/td>\n As MedTunnel does not permanently\n store PHI, this standard does not apply\n to us.<\/td>\n <\/tr>\n
         <\/td>\n Media re-use (R)<\/td>\n Implement procedures for removal of\n electronic protected health information\n from electronic media before the media\n are made available for re-use.<\/td>\n As MedTunnel does not permanently\n store PHI, this standard does not apply\n to us. However, we are able to advise\n our customers on how to do this.<\/td>\n <\/tr>\n
         <\/td>\n Unique user\n identification (R)<\/td>\n Assign a unique name and\/or number for\n identifying and tracking user identity.<\/td>\n MedTunnel\u2019s secure messaging\n applications assign a unique MedTunnel\n ID to each user so that they are the only\n ones who can decrypt the messages\n received.<\/td>\n <\/tr>\n
         <\/td>\n Emergency access\n procedure (R)<\/td>\n Establish (and implement\n as needed) procedures for obtaining\n necessary electronic protected health\n information during an emergency.<\/td>\n MedTunnel\u2019s secure messaging\n applications are realtime and allows\n users to access data no matter where\n they are located as long as there is\n network connectivity.<\/td>\n <\/tr>\n
         <\/td>\n Automatic log-off (A)<\/td>\n Implement electronic procedures that\n terminate an electronic session after a\n predetermined time\n of inactivity.<\/td>\n MedTunnel\u2019s secure messaging\n applications the end user to set the autologoff\n settings.<\/td>\n <\/tr>\n
         <\/td>\n Encryption and\n decryption (A)<\/td>\n Implement a mechanism to encrypt and\n decrypt electronic protected health\n information.<\/td>\n MedTunnel\u2019s secure messaging\n applications provide true end-to-end\n encryption. Message traffic is encrypted\n with 2048 bit RSA keys as wells as with\n a 256 bit AES-CBC. The sender\n encrypts the message and only the\n intended receiver can decrypt the\n message.<\/td>\n <\/tr>\n
        Audit controls\n 164.312(b)<\/td>\n (R)<\/td>\n Implement hardware, software, and\/or\n procedural mechanisms that record\n and examine activity in information\n systems that contain or use electronic\n protected health information.<\/td>\n At MedTunnel, we provide the tools so\n that the account owner or group\n administrator can monitor system usage.<\/td>\n <\/tr>\n
        Integrity\n 164.312(b)<\/td>\n Mechanism to\n authenticate electronic\n protected health\n information (A)<\/td>\n Implement electronic mechanisms to\n corroborate that electronic protected\n health information has not been altered or\n destroyed in an unauthorized manner.<\/td>\n As MedTunnel does not have access to\n PHI, this standard does not apply\n to us.<\/td>\n <\/tr>\n
        Person or entity\n authentication\n 164.312(d)<\/td>\n (R)<\/td>\n Implement procedures to verify that a\n person or entity seeking access to\n electronic protected health information is\n the one claimed.<\/td>\n At MedTunnel, we provide the tools so\n that the account owner or administrator\n for a group can control access to the\n PHI.<\/td>\n <\/tr>\n
        Transmission\n security\n 164.312(e)(1)<\/td>\n Integrity controls (A)<\/td>\n Implement security measure to ensure\n that electronically transmitted electronic\n protected health information is not\n improperly modified without detection\n until disposed of.<\/td>\n The integrity of the PHI transmitted\n within our secure messages is\n automatically maintained due to their\n end-to-end encryption.<\/td>\n <\/tr>\n
         <\/td>\n Encryption (A)<\/td>\n Implement a mechanism to encrypt\n electronic protected health information\n whenever deemed appropriate.<\/td>\n All data sent using a MedTunnel\n application is end-to-end encrypted and\n uses SSL\/TLS between the client and\n our cloud server.<\/td>\n <\/tr>\n <\/tbody>\n <\/table>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
        \n\t\t\t\t
        \n\t\t\t\t\t\t\t

        Revised 8\/11\/15<\/small><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

        Why are Email and Text Messaging Not HIPAA compliant? Many people falsely believe that traditional email and texting of private health information is HIPAA compliant.\u00a0 This is simply not true and anyone who is currently using these methods is putting their organization at risk. HIPAA regulations require that all private health information (PHI) remain private […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/pages\/2244"}],"collection":[{"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/comments?post=2244"}],"version-history":[{"count":43,"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/pages\/2244\/revisions"}],"predecessor-version":[{"id":2292,"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/pages\/2244\/revisions\/2292"}],"wp:attachment":[{"href":"https:\/\/medtunnel.com\/wp-json\/wp\/v2\/media?parent=2244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}