HIPAA and PHI handling
Identify the organizations, services, and protected health information involved before assessing HIPAA responsibilities. Include stored data and attachments, not only prompts.
Do not send PHI until the required agreement, deployment, access, and security controls are approved.
Determine whether VeriProof receives PHI
VeriProof records the data that your integration sends. Review prompts, outputs, attributes, attachments, logs, and error details before enabling capture.
If VeriProof creates, receives, maintains, or transmits electronic PHI for a covered entity or business associate, confirm the required written agreement before use. See HHS cloud-computing guidance . Encryption alone does not remove the need to assess business-associate responsibilities.
Limit captured data
Send only the information needed for the approved governance purpose. Configure supported sensitive-field controls and test them with representative non-production records.
Pattern-based redaction does not identify every name, address, image, document, or clinical detail. Remove unnecessary PHI at the source.
Review safeguards
Assess the complete operating environment, including:
- identity, role, and service access;
- encryption and key ownership;
- audit and evidence access;
- incident handling and notification terms;
- backup, recovery, retention, and deletion;
- approved regions and subprocessors; and
- customer and VeriProof responsibilities.
The selected agreement and deployment evidence define the applicable controls. A product feature list does not establish HIPAA compliance.
Validate evidence workflows
Use non-production data to confirm:
- unauthorized roles cannot view PHI-bearing records;
- authorized users can find the records needed for an approved review;
- exports contain the intended fields and exclude unnecessary data;
- retention and deletion behavior matches the approved procedure; and
- audit records identify the relevant user, action, and time.
Confirm the agreement
Use the enterprise inquiry form to confirm whether a Business Associate Agreement is available for the proposed service and deployment.
The signed agreement defines permitted use, safeguards, reporting, and termination duties.