Because telemedicine and telehealth platforms rely on electronic transmission of ePHI, they must be compliant with federal HIPAA regulation.

The most effective way to ensure that your telehealth SaaS application or telehealth platform is safely maintaining ePHI is by implementing a total HIPAA compliance program that addresses the full extent of the law. But how exactly do these standards apply under HIPAA regulation and how can you ensure you’re keeping your sensitive health care data safe?

Healthcare SaaS Compliance

HIPAA regulation is essentially a set of national privacy and security standards that all health care professionals must address to safeguard protected health information (PHI). PHI is any demographic information that can be used to identify a patient. Common examples of PHI include a patient’s name, address, telephone number, full facial photo, email address, financial information, medical record, or Social Security number, to name a few. PHI that is stored, processed, or transmitting in an electronic format is called electronic protected health information (ePHI).

As per HIPAA regulation, there are two classes of entities that are beholden to the law. These include:

• Covered entity (CE): any provider, insurance plan, or healthcare clearinghouse involved in payment, treatment, or operations and who necessarily handle or create PHI.
• Business associate (BA): any vendor hired to perform a task that necessarily involves handling, transmitting, storing, or maintaining PHI. Common examples of BAs include IT providers, video chat clients, billing services, hosting services, cloud storage providers, and many more.

If you are a telehealth provider, that means you are a covered entity. If you are a provider of a telehealth platform by which providers can deliver telehealth services, then you’re a business associate.

Software-as-a-Service (SaaS) providers servicing telehealth providers are also considered business associates, and are subject to HIPAA business associate regulation.

For SaaS providers in the telehealth space, there are many requirements that must be addressed in order to safeguard ePHI. Below, we describe some of those requirements for SaaS compliance that all telehealth platform providers should know.

• Self-Audits to find gaps in your compliance program
• Remediation Plans to fix problems that you uncover
• Policies and Procedures, forming the backbone of your compliance program
• Employee Training and Attestation on an annual basis
• Vendor Management to monitor business associates and execute Business Associate Agreements
• Incident Tracking to investigate data breaches should they occur

If you’re interested in learning more about any of these HIPAA compliance requirements for SaaS telehealth platforms, schedule a consultation today with one of our HIPAA experts! We’ll answer your questions and help guide you through your regulatory requirements to help keep your business safe.