Dropbox & HIPAA

[bcliff]

Anyone have any experience using Dropbox with patient information? I have a password protected account that sends a passcode to my phone every time I need to login, so in order to login you would need to know my password and have access to my cellphone, which also has a password.

---

Members don't see this ad.

 

[WisNeuro]

Dropbox is not currently HIPAA certified. Do not use.

 

[bcliff]

Good to know - Thanks. Do you know any comparable programs that are HIPAA certified?

 

[WisNeuro]

I don't know any approved for private use, just some that are approved for institutional use. I think companies like ClearData cater to healthcare institutions.

 

[paramour]

Perform a search for HIPAA compliant cloud solutions/strategies. Most of the ones I'm familiar with are for health services/institutions or small business as WisNeuro mentioned. I seem to recall running across a few "private" options but (if I recall correctly) they typically mentioned that they could not claim to be HIPAA complaint for whatever reason.

And Dropbox is a pain in the arse.

 

[neuronic]

Remote desktop access is probably your best bet.

 

[thinkingmedical]

There a HIPAA Cloud tool that is more focused on input and multiple team member access:
http://florencehc.com/eprintfromehr/

 

[EverHopeful]

Box.com is HIPPA compliant and has the option to sign a BAA. However, you have to have one of their paid accounts to get the BAA aggreeement. This is the closest that I've found to HIPPA compliance in cloud based storage. Here is the link to their HIPPA info: https://community.box.com/t5/Account-Information/Box-HIPAA-And-HITECH-Overview-And-FAQs/ta-p/16

 

[deleted343839]

Good to know - Thanks. Do you know any comparable programs that are HIPAA certified?

Box is very secure, but even so I would only use it with your institution's blessing. Make sure you're not violating some kind of policy such that you'd be in hot water in the event of a breach.

 

[Ollie123]

Another vote for Box, but check the rules.

My institution pays for a subscription for everyone (presumably because they know if they didn't people would just use Dropbox anyways and security be damned). There are still some limits at what you can put on there (think they draw the line at SS#'s), but they are FAR more liberal.

 

[BuckeyeLove]

the forensic practice I just joined uses it. haven't actually dug into the legalities too much since my boss is also an attorney

 

[futurepsydoc]

I agree with others. Check with your institution/employer re: policies and procedures. If at all possible, I would recommend using some form of remote connection with the institution/employer servers that it is secure. If you wish to use something different, I would speak with people in the compliance dept re the program you are interested in using.