The Office for Civil Rights (OCR) recently released guidance to aid app developers in navigating the Health Insurance Portability and Accountability Act (HIPAA). In particular, the guide provides scenarios where HIPAA regulations might apply to mobile health applications.
“We hope these new scenarios will help developers determine how federal regulations might apply to products they are building,” wrote Jocelyn Samuels, Director of the OCR. “We also hope they will reduce some of the uncertainty that can be a barrier to innovation.”
Specifically, the OCR guidance addresses two questions: How does HIPAA apply to health information that a patient creates, manages or organizes through the use of a health app? When might an app developer need to comply with HIPAA?
The guidance first walks through two circumstances in which an app developer might be required to comply with HIPAA. First, HIPAA would apply to an app developer who works for a covered entity and, as a part of his or her job, is creating an app that involves the use or disclosure of protected health information (PHI). Second, even if a developer is not a covered entity under HIPAA, he or she may be a business associate if he or she is creating or offering an app on behalf of a covered entity. In such case, the app developer must comply with HIPAA.
Perhaps most useful are the six scenarios addressed in the guide.
One, for instance, reads as follows: “Doctor counsels patient that his BMI is too high, and recommends a particular app that tracks diet, exercise, and weight. Consumer downloads app to his smartphone and uses it to send a summary report to his doctor before his next appointment.” Is this app developer a HIPAA business associate? No. The developer is not creating, receiving, maintaining or transmitting PHI on behalf of a covered entity or another business associate. While the physician’s recommendation implies trust in the app, there is no indication that the physician hired the app designer to provide services to patients involving the handling of PHI.
To read the full guide and to review all of the OCR’s scenarios,
click here.