" video conferencing Archives - LuxSci FYI Blog: Learn about HIPAA email encryption, secure email encryption, and more

Posts Tagged ‘video conferencing’

Is Skype HIPAA Compliant? If not, what is?

Saturday, May 9th, 2020

Doctor using Skype for telehealth

In recent times we have seen a huge push toward telehealth, so many are wondering, “Is Skype HIPAA compliant?” While Skype is a practical tool that many people have access to, it’s important to consider any regulatory obligations you need to meet before you use it.

If your business collects, stores, transmits or processes electronic protected health information (ePHI), then it is subject to HIPAA regulations. Organizations that process ePHI on behalf of other parties also need to stick within the rules, otherwise they may face heavy fines.

Regardless of whether your organization provides health services through video or it uses video platforms to process ePHI in any other way, it needs to make sure it is using software that abides by the regulations.

Wondering, “Is Skype HIPAA compliant?” is a good starting point, but there are several things to consider before you commit to a video conferencing service.

Do You Need a BAA to Make Skype HIPAA Compliant?

A business associates agreement (BAA) is a contract between your organization and any others that process its data. In essence, these agreements outline how ePHI will be used, what control measures will be in place, and where the responsibilities lie between the two parties.

BAAs are absolutely necessary for HIPAA compliance. Even if your organization and its partner share ePHI with every control and security mechanism imaginable, as well as following all other aspects of the regulations, it would still be violating HIPAA if a signed BAA was not in place.

If your organization is going to be sharing ePHI over a video service, then it needs to be HIPAA-compliant.* However, the only way that it can be HIPAA compliant is if a BAA is in place.

Is Only the Business Version of Skype HIPAA Compliant?

Skype comes in several different versions, but the basic, consumer oriented one is not HIPAA compliant. The only type that offers BAAs and which could be made HIPAA compliant is Skype for Business, which is one of Microsoft Office’s business communication tools.  Note that “Skype for Business” is a completely different service than consumer Skype. 

However, it’s also worth noting that Skype for Business is currently being phased out in favor of Microsoft Teams. If you don’t already have a supported version of Skype for Business, you should look for HIPAA-compliant alternatives instead. Support for Skype for Business Online ends in 2021, while support for Skype for Business Server will be extended until 2025.

With this in mind, it’s probably not worthwhile pursuing any version of Skype for HIPAA compliance. If you use the basic version of Skype, you will be violating the regulations, and even if you can get Microsoft to sign a Skype for Business BAA, you may have to switch your software in 2021 anyway.

HIPAA-Compliant Alternatives to Skype

Considering that Skype for Business doesn’t have much time left and that it is not even the same as “regular Skype,” your organization will be better off finding a HIPAA-compliant alternative. One option is LuxSci’s SecureVideo, which was designed specifically to make it easy to stay within the regulations.

SecureVideo was developed from the ground up with HIPAA compliance in mind, ensuring that it became a practical video calling service that made security and compliance simple. The Zoom for Healthcare-based platform is great for telemedicine and other forms of sharing ePHI.

SecureVideo includes handy features like screen-sharing, file-sharing and virtual clinics, with a capacity of up to 100 participants. This makes LuxSci’s SecureVideo a convenient and compliant alternative to Skype.

 

* During the Covid-19 pandemic, HHS has waived responsibility for breaches through non-compliant video conferencing services, like Skype.  So, while Skype may not be compliant, it is OK to use during the pandemic.  However, as the pandemic subsides and this waiver is lifted, you should have transitioned to a service that is actually HIPAA compliant.

Working from Home? Is Zoom HIPAA-Compliant for Video Conferences & Calls?

Monday, March 30th, 2020

 

Zoom Vide

 

In the midst of the coronavirus crisis and with many working from home, many businesses may be wondering: Is Zoom HIPAA-compliant?

While it is true that President Trump has relaxed HIPAA-compliance requirements around telehealth (which includes video teleconferencing) for the duration of the Covid-19 pandemic, the pandemic will eventually end and companies who have invested time and money accelerating their telehealth infrastructure would prefer to not have to change everything because they chose a non-compliant solution and now compliance is “back on the table.” We’re all slightly on edge and out of rhythm at the moment, but HIPAA regulations and the immense costs of data breaches for telehealth will be back.

The situation is serious, and we need to act quickly to put ourselves in the best position to ride this out. But we also need to be careful with our decision-making and ensure that these changes don’t have any disastrous effects.

If your company is involved in processing ePHI and intends to use video-conferencing and calls to allow people to work from home, it needs to know whether Zoom is HIPAA-compliant.

What Is Zoom Video Communications?

Zoom Video Communications is a company behind a range of different services, mainly associated with video calls, video-conferencing and other types of online collaboration. It has become quite popular over the past few years, particularly for business use, so it may be the first platform organizations turn to now that many employees are working from home.

Do Video Call Solutions Like Zoom Need to Be HIPAA-Compliant?

doctor-patient medical call

If your organization is involved in healthcare or it processes electronic protected health information (ePHI) on behalf of others, then it needs to be cognizant of the HIPAA regulations and always deal with the data appropriately.

This applies when data is collected, stored, and transmitted, whether by email or any other type of technology. This includes video calls and conferences. Perhaps this is easy to overlook, because many of us don’t personally store the video data from our calls – but that doesn’t mean the information can’t be intercepted by attackers or accidentally leaked, both of which can have significant repercussions for victims.

If a video calling platform is not HIPAA-compliant and is poorly secured, it’s possible for attackers to insert themselves and either access or record calls. This information can then be used in a range of crimes, ranging from extortion to identity theft.

Organizations that are found to violate HIPAA can be met with severe penalties, including up to $50,000 for each civil violation, or up to $250,000 and 10 years imprisonment for each criminal violation.

Is Zoom HIPAA-Compliant for Video Calls & Teleconferences?

The short answer is not necessarily, but Zoom HIPAA compliance is possible. The first thing that you need to know is that the standard offerings of Zoom are not HIPAA-compliant

Why aren’t these types of Zoom HIPAA-compliant? The simple answer is that they were designed for other purposes, which means that they should never be used for any calls that could involve ePHI.

If you’re a diehard Zoom fan, then you’re not completely out of luck, because one of its offerings – Zoom for Healthcare – is HIPAA-compliant. However, there are strings attached. As with any service that your organization shares its ePHI with, a business associates agreement (BAA) needs to be signed with the company. This is a contract that stipulates the conditions and where responsibility lies.

If your organization does choose Zoom, it needs to make sure that it only uses its service within the confines of the BAA.

Are There Other Platforms Apart from Zoom for HIPAA-Compliant Video Calls?

Zoom for Healthcare may not fit every organization’s work flows and HIPAA compliance needs, but thankfully there are alternatives.

LuxSci Secure Video is one option.  Secure Video is built on top of Zoom for Healthcare (so it uses all the same applications and distributed infrastructure that everyone is used to) and has scheduling, work flows, payment processing, and other features that make it especially useful for sessions with patents and for group meetings where sensitive information will be discussed.

 

Luxsci Secure Video

 

 

 

What Is HIPAA-Compliant Videoconferencing?

Monday, October 10th, 2016

HIPAA-compliant videoconferencing is a form of telecommunication used in health settings, allowing multiple parties (e.g. doctor and patient) to communicate via two-way video and audio transmissions. It provides patients with the same privacy and confidentiality that applies to in-person visits, protecting their information and giving the same care to storage and dissemination of the video as to paper documents under the Health Insurance Portability and Accountability Act (HIPAA).

There are many advantages to videoconferencing with patients, rather than meeting them in-person. Some patients have limited mobility, making it difficult for them to physically visit a healthcare provider. Some patient follow-ups only require a quick conversation and don’t require a physical examination. For many patients, it may also be much more convenient to have a video conversation than to travel to doctor’s office.  An additional benefit is the cost savings; videoconferencing can be much cheaper than in-person visits.

Read the rest of this post »

LUXSCI