HIPAA Compliant Team Collaboration Tools

FaceTime isn’t designed to be used as a telecommunications tool in a healthcare setting.

For HIPAA compliance, users need to purchase a paid plan for G Suite, purchase Google Voice, and sign the G Suite BAA.

eFax is an electronic faxing solution that uses advanced security protocols to make sure ePHI is secure both during transmission and in storage. eFax is known as one of the most secure online fax providers. eFax uses unique user identification and 256-bit SSL encryption to ensure secure document transmission and keep ePHI safe from unauthorized access. eFax also offers secure transport layer security (TLS) encryption protocol, administration privileges to limit access to ePHI, and multilevel audit controls, including secure and automatic fax archiving. Fax transmissions are stored on the eFax cloud and kept safe in Tier III secure servers.

Metrofax offers secure, encrypted fax communication services. The built-in faxing features allow users to quickly send information from a cell phone or computer as a fax.Even though Metrofax provides encryption to protect transmitted information, it’s missing a few capabilities required for HIPAA compliance. When sharing PHI through a third-party provider, HIPAA regulations require a signed Business Associate Agreement. This BAA must be in place for Metrofax’s services to meet HIPAA compliance.Since Metrofax doesn’t sign a BAA, it is not HIPAA compliant and shouldn’t be used with PHI.

Teamviewer says that it is a HIPAA-compliant remote access solution that allows users to access devices no matter where they are.Security is a key objective for Teamviewer. The company has received multiple security certifications from A-LIGN, a provider that helps businesses implement HIPAA-compliant security features.All of Teamviewer’s remote support, remote access, and online collaboration features maintain the level of privacy and security necessary for HIPAA compliance. This includes end-to-end encryption, which is why many companies trust Teamviewer.HIPAA has strict standards for the privacy and confidentiality of patient information. When using computers, networks, and mobile devices for PHI, all access and management must follow HIPAA regulations. Additionally, every employee must receive regular HIPAA training. Teamviewer’s security and privacy practices meet HIPAA compliance standards.Before using Teamviewer with PHI, you must get a signed BAA from the company. Since Teamviewer is a third party that could access PHI on your computers and devices, the BAA ensures that protections are in place if Teamviewer exposes PHI. The potential risk involved in remote access opens up the possibility of unauthorized access to PHI. Teamviewer mitigates this risk using encryption and security features to protect information. Submit an inquiry to Teamviewer customer service for assistance in obtaining the BAA. A signed BAA might be available only for organizations that meet a specific spending threshold. The company reviews each situation on a case-by-case basis, so you must contact Teamviewer to discuss a BAA. It’s a HIPAA violation to use Teamviewer before you have a signed BAA in place.

Sharepoint declares that it provides necessary administrative and technical features to meet HIPAA compliance. Some of these features include access control for users, audit control, logs, and encryption. Threat awareness resources make it easy to access real-time reports about information access and usage.Sharepoint is a Microsoft service. The Microsoft website states that Sharepoint online is HIPAA compliant when paired with Office 365 Enterprise. While Microsoft ensures it meets its responsibilities as a business associate, users are responsible for configuring the platform correctly.A variety of security add-ons are included for Office 365 Enterprise users, such as advanced threat protection, security management, advanced compliance, and threat intelligence. Licensing includes anti-malware, Windows Defender, Cloud App Security (CAS), Azure AD Identity Protection, Azure Security Center, Azure Advanced Threat Protection, and more.If you are a HIPAA covered entity, then you must follow HIPAA regulations. For example, you must control how data is shared, used, published, and updated. Always classify sensitive data to ensure monitoring, protection, and appropriate access controls for storage and information transit.Microsoft is willing to sign a Business Associate Agreement (BAA) for organizations that use Sharepoint for patient health information. This BAA is for Office 365 Enterprise, which also covers Sharepoint Online. Without this signed BAA, HIPAA-covered entities shouldn’t use this platform for protected health information.If you configure and use Sharepoint correctly and obtain a BAA, then this service can be a HIPAA-compliant solution for information storage, management, and collaboration.

Grasshopper has informed that it isn’t HIPAA compliant. Its website states that support team members have access to account information and settings to help with technical issues. This access includes all messages that pass through Grasshopper’s calling, texting, and faxing features.If protected health information (PHI) passes through these communication tools, then it’s possible for unauthorized individuals to access the information. Grasshopper doesn’t offer HIPAA-compliant services, so covered entities shouldn’t use these tools.

Many telecommunication firms act as conduits for data transmission and are exempt from signing a business associate agreement (BAA) through the conduit exception rule. Information shared over the phone or using a standard fax machine is not subject to HIPAA compliance. However, other means of communication, including VOIP, SMS, and digital fax services, must meet HIPAA regulations.Since HelloFax uses digital faxing, not regular fax machines, the service must provide privacy and security features if covered entities are using the system. HelloFax provides AES-256-bit encryption for information at rest and TLS encryption for information in transit, meeting the minimum HIPAA standards. Additionally, each document is encrypted with a unique key, and keys are encrypted with a master key that rotates frequently, which means that if unauthorized people gained access to the hard drive, they wouldn’t be able to decrypt the data.HelloFax advertises “bank-grade” security, including physical and electronic protections. The data center uses strict access controls at all times. Because of these security measures, it is possible to use the HelloFax system without violating HIPAA requirements.The company website doesn’t state that HelloFax will sign a business associate agreement (BAA). But larger companies with high annual spending have secured BAAs with HelloFax. Contact HelloFax support for a BAA.

While MyFax offers a variety of security and privacy features, this service doesn’t says that it meets HIPAA requirements. The privacy features of this digital faxing service are more robust than traditional fax machines, but they aren’t sufficient for protected health information.Also, MyFax won’t sign a business associate agreement (BAA).The company J2 Global owns both MyFax and eFax. These platforms are similar, but there are notable differences in privacy, security, and faxing capabilities. MyFax suggests that covered entities use services from its partner, eFax Corporate, which is HIPAA compliant and will sign a BAA.

LogMeIn is remote-access software that falls under the “technical safeguards” category of the Health Insurance Portability and Accountability Act (HIPAA). Covered entities using this tool must implement protections to prevent unauthorized access of protected health information (PHI).HIPAA compliance requires strict measures for access control, including unique user identification, emergency access procedures, automatic logoff features, person authentication, and audit controls. LogMeIn meets all of these requirements, but customers must adjust specific account settings before using the service with PHI.LogMeIn also offers transmission security that meets HIPAA requirements. All data transmitted during chat, remote-access, or file-transfer sessions is protected with 128-bit encryption at minimum. When permitted by the encryption level on the client’s browser, the protection increases to 256-bit encryption.To support customers in meeting HIPAA requirements, LogMeIn provides a detailed outline of considerations and setting recommendations. These technical safeguards and transmission security features enable covered entities to maintain compliance with HIPAA’s Privacy and Security Rules.In addition, LogMeIn will sign a business associate agreement (BAA) for corporate customers that have annual contracts.

Quip, a cloud-based collaboration tool, uses innovative security controls and measures that align with HIPAA compliance requirements. The system is fully encrypted and offers a variety of customizable privacy options to meet each organization’s unique compliance requirements.Covered entities often pair Quip Shield with Salesforce to take their security to the next level. The combination allows users to collaborate using Salesforce data in a central space while their data is protected with critical security measures such as permissions, version history, and encryption.These cloud-based tools offer security for protected health information (PHI), with technical, physical, and administrative safeguards to maintain compliance. Covered entities can build healthcare applications through Salesforce, knowing that Quip provides the security measures needed to protect PHI.Quip is secure out of the box, with features that allow for data control and audits. Users can tailor the Quip platform based on their unique compliance and security needs. Key security features of Quip Shield include encryption of data in transit and at rest, granular administrative controls, access management, antivirus scanning, and real-time event logging. The option of a private, single-tenant cloud allows for better control of the network, including limits on geographical access.A signed business associate agreement (BAA) is available for covered entities using Quip for PHI. This BAA covers Quip Starter, Quip Enterprise, Quip Mobile, Quip Virtual Private Cloud, Quip for Salesforce, and the Quip Live App.