Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Download PDFDownload PDF
Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Formstack
/
June 16, 2017
Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

MIN
/
June 16, 2017
About the Episode
Episode Highlights
Meet our Guest
Episode Transcript

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Get the Report

Great, thank ya!

You can now access the content.
Oops! Something went wrong while submitting the form.
Blog

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Panelists
No items found.
Introduction
Introduction

Great, thank ya!

You can now access the content.
Download NowDownload Now
Oops! Something went wrong while submitting the form.

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

Panelists
No items found.
Infographic

Webinar Q&A: Top 10 Questions from Our ePHI Cyber Risk Management Webinar

Review the top questions and answers from Formstack's ePHI cyber risk management webinar with George Bailey of Purdue Health Advisors and Formstack.
Download InfographicDownload Infographic

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

Collecting payments with online forms is easy, but first, you have to choose the right payment gateway. Browse the providers in our gateway credit card processing comparison chart to find the best option for your business. Then sign up for Formstack Forms, customize your payment forms, and start collecting profits in minutes.

Online Payment Gateway Comparison Chart

NOTE: These amounts reflect the monthly subscription for the payment provider. Formstack does not charge a fee to integrate with any of our payment partners.

FEATURES
Authorize.Net
Bambora
Chargify
First Data
PayPal
PayPal Pro
PayPal Payflow
Stripe
WePay
ProPay
Monthly Fees
$25
$25
$149+
Contact First Data
$0
$25
$0-$25
$0
$0
$4
Transaction Fees
$2.9% + 30¢
$2.9% + 30¢
N/A
Contact First Data
$2.9% + 30¢
$2.9% + 30¢
10¢
$2.9% + 30¢
$2.9% + 30¢
$2.6% + 30¢
Countries
5
8
Based on payment gateway
50+
203
3
4
25
USA
USA
Currencies
11
2
23
140
25
23
25
135+
1
1
Card Types
6
13
Based on payment gateway
5
9
9
5
6
4
4
Limits
None
None
Based on payment gateway
None
$10,000
None
None
None
None
$500 per transaction
Form Payments
Recurring Billing
Mobile Payments
PSD2 Compliant

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

VIEW THE WEBINAR RECORDING!

Cyber risk management is a growing issue in 2017, and keeping ePHI secure from the threat of data breaches is critical for all organizations that collect, store, and use that information. For this reason, Formstack partnered with healthcare information security expert George Bailey to discuss HIPAA security standards and best practices for HIPAA compliant data collection. Here are some of the top questions asked and answered during the Q&A portion of the webinar:

1. What are some of the most common security issues that healthcare organizations encounter?

Here are three common security issues faced by healthcare organizations of all sizes:

  1. Regardless of the size of the organization, outdated software is a very common issue. Making sure software is updated as quickly as possible will help reduce risk—from your operating system, to third-party apps like Acrobat and Flash Player, to your web browser.
  2. In many cases, computer networks aren't segmented or isolated appropriately. For example, servers that host an EHR should be segmented and secured at a higher level than any other servers in the network.
  3. Many organizations fail to enforce strong authentication systems. Password requirements aren't what they need to be—with modern technology, passwords aren't as secure until they hit the 12-14 character mark. This may not be necessary for all users within your system, but it should apply to anyone with administrative access.

2. Are there guidelines for determining if data is collected in a form that falls under the HIPAA Security Rule?

There are 18 identifiers that constitute PHI in conjunction with a patient's name. Some of these 18 components might not seem identifying, but if you collect this information from a patient as a healthcare provider and a covered entity, you have an obligation to treat it as PHI. There are other statistical factors that must be factored in—for example, a name and a prescription might not be enough to identify or re-identify a patient in a community with a large population, but in a rural community with a low population, the two data points could easily be used to re-identify a patient.

3. If employees on the network routinely leave their computers unlocked, is that considered a HIPAA violation?

Leaving your computer unlocked is not considered a HIPAA violation in itself. However, if unauthorized personnel were to use that workstation and view PHI without having a business need to do so, that would be considered a HIPAA violation. Locking your work station is definitely a best practice and a cost-effective way to mitigate that risk.

hipaa hippo

4. Is HIPAA compliance similar to FERPA when it comes to higher education?

FERPA is the equivalent to HIPAA for higher education. FERPA is a confidentiality framework, whereas HIPAA applies to privacy, confidentiality, and access. There are many similarities that connect FERPA and HIPAA. Whether your institution is subject to both of these regulations or not, it’s important to understand the rights of students and patients, and who is (or is not) entitled to their information.

Read More: Check out this blog post for more details on the similarities and differences between FERPA and HIPAA compliance!

5. What is the difference between a Formstack HIPAA account and a regular Formstack account?

There are several factors that differentiate a Formstack HIPAA account from a regular Formstack account:

  • Signed BAA: Formstack signs a BAA with HIPAA customers, making us liable for the data if a breach ever occurred.
  • Encrypted Submissions: Form submissions that include PHI must be encrypted to meet HIPAA compliance standards. This includes TLS encryption (TLS 1.0, 1.1, and 1.2).
  • Dedicated Security Team: We have a security team that would handle a breach if it were to occur, and the team monitors HIPAA accounts heavily to mitigate all risks.
  • Priority Support: HIPAA accounts receive a dedicated onboarding specialist and priority support, so you aren't waiting nearly as long to have your questions answered or your issues resolved.
  • Audit Logging: Formstack is able to provide a detailed account activity log in the event of a security breach to help identify which user(s) accessed or exported sensitive data.

6. In the absence of a BAA, does the responsibility of a breach fall on the healthcare provider that compiles the data?

Yes. We sign a BAA taking on the liability for the data if there is ever a breach, but if a BAA is not signed, the healthcare provider is liable for any data breach.

7. Can you put safeguards onto existing Formstack forms, or do you have to re-create a form using Formstack's HIPAA compliant product?

The Formstack platform is not HIPAA compliant out of the box—collecting PHI on a standard Formstack account is a violation of our Terms of Service. Users are able to convert current Formstack accounts to a HIPAA compliant account, or they can start using the HIPAA compliant product from scratch on a new account.

8. How are some of Formstack's HIPAA customers using the platform?

A few use cases include patient registration, patient experience, and call centers that handle medical ordering (e.g., pharmaceutical, telemedicine, and home healthcare). In general, if your healthcare organization is using clunky, paper-based processes, Formstack can help you stay HIPAA compliant while adding security and efficiency with workflow and automation.

9. Where can we learn how to use Formstack to send ePHI into our EHR system?

Formstack has a HIPAA compliant API and is getting ready to launch HIPAA compliant webhooks so your team can route data to any key systems you have in place. To learn more about sending ePHI into your EHR system before signing up for a Formstack HIPAA account, contact sales@formstack.com. If you're already using a Formstack HIPAA account, contact your priority support representative.

10. What makes Formstack different than other HIPAA compliant form builders?

The two biggest reasons people choose Formstack over other form builders are our robust system and our priority support. Our system is so easy to learn that most users can pick up on it within 30 minutes without any coding experience. This is because the forms are all drag and drop.Formstack HIPAA customers have access to priority support, including their own onboarding specialist and someone to address their support questions. Most questions are answered within two hours if the support specialist can respond via email, or within 24 hours if a phone call is needed.

To learn more about Formstack's HIPAA compliant platform, integrations, and offerings, click the link here!

Formstack
Formstack is a SaaS company with a mission to help organizations digitize what matters, automate workflows, and fix processes—all without code. A variety of team members come together to compile posts under Formstack's authorship.
More Articles
Meet The Host
CEO of
Connect
Chris is on a mission to turn people into great leaders. He's passionate about helping problem solvers see more value in the work they do every day.