6 min read
Is WhatsApp HIPAA Compliant? No - Here Is Why
Meta does not sign Business Associate Agreements for WhatsApp. The app lacks audit logs, admin controls, and data retention needed for HIPAA compliance.
HIPAA Compliance Articles: Page 3
More expert guidance on Business Associate Agreements, workforce training documentation, and enforcement trends from the HHS Office for Civil Rights that affect covered entities and business associates. Each article is written for compliance officers, practice managers, and IT administrators who need clear answers without legal jargon.
6 min read
5 min read
Is iCloud HIPAA Compliant? No - Here Is Why
Apple does not sign Business Associate Agreements for iCloud, making it non-compliant for PHI. This covers iCloud Drive, Mail, iMessage, FaceTime, and backups.
6 min read
Is Gmail HIPAA Compliant? Free vs. Workspace Explained
Is Gmail HIPAA compliant? Only through paid Google Workspace with a BAA. Free @gmail.com accounts are never compliant. Learn required settings and common email mistakes.
6 min read
Is Dropbox HIPAA Compliant? What Healthcare Practices Need to Know
Is Dropbox HIPAA compliant? Only on paid team plans with a signed BAA. Learn which plans qualify, required settings, common mistakes, and how Dropbox compares to Google Drive.
5 min read
Is Slack HIPAA Compliant? Enterprise Grid Requirements Explained
Is Slack HIPAA compliant? Only on Enterprise Grid. Slack Pro and Business+ do not qualify. Learn the restrictions, costs, and better alternatives for healthcare practices.
4 min read
Is Microsoft Teams HIPAA Compliant? What Healthcare Practices Need to Know
Is Microsoft Teams HIPAA compliant? Yes, on eligible Microsoft 365 plans with automatic BAA coverage. Learn which plans qualify, required settings, and common mistakes.
5 min read
Is Google Drive HIPAA Compliant? What Practices Need to Know
Is Google Drive HIPAA compliant? Only with a paid Google Workspace plan and a signed BAA. Learn required settings, common mistakes, and how to set up Drive for healthcare.
6 min read
Is Zoom HIPAA Compliant? What Healthcare Practices Need to Know
Is Zoom HIPAA compliant? Only on paid plans with a signed BAA. Learn which plans qualify, how to request the BAA, required settings, and the mistakes that put practices at risk.
11 min read
HIPAA Compliance for Websites: Does Your Practice Website Need to Be Compliant?
Does your practice website need to be HIPAA compliant? Learn which features trigger HIPAA requirements and what to fix right now.
Key HIPAA terms used in these articles
Plain-language definitions of the terms that appear throughout the blog, each tied to the regulation it comes from.
- Protected Health Information (PHI)
- Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium (45 CFR 160.103).
- Electronic PHI (ePHI)
- PHI that is created, received, maintained, or transmitted in electronic form (45 CFR 160.103).
- Covered Entity
- A health plan, health care clearinghouse, or health care provider that transmits health information electronically (45 CFR 160.103).
- Business Associate
- A person or company that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as billing, IT, or cloud vendors (45 CFR 160.103).
- Business Associate Agreement (BAA)
- The written contract HIPAA requires between a covered entity and a business associate (45 CFR 164.502(e), 164.504(e)).
- Security Rule
- The standards for protecting ePHI through administrative, physical, and technical safeguards (45 CFR Part 164, Subpart C).
- Security Risk Assessment (SRA)
- The accurate and thorough risk analysis the Security Rule requires you to conduct and document (45 CFR 164.308(a)(1)(ii)(A)).
- Breach Notification Rule
- After a breach of unsecured PHI, individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery, and HHS must be notified (45 CFR 164.400 to 164.414).