“HIPAA compliant” shows up on almost every healthcare software page. For a medical writing team, the phrase raises more questions than it answers. Does HIPAA even apply to this draft? What does the vendor actually have to sign? And what should you ask before pasting anything in?<\/p>\n
Here is a plain-language way to work through it. This is general information, not legal advice, so confirm specifics with your compliance or legal team.<\/p>\n
HIPAA applies to covered entities, such as healthcare providers and health plans, and to their business associates. A document is not covered just because it is medical.<\/p>\n
What matters is who you are and where the content came from. A published-data summary is a different case from a clinic note, a site narrative, or a case report built from patient records. The closer a draft sits to identifiable patient information handled on behalf of a covered entity, the more likely HIPAA is in play.<\/p>\n
Protected health information is health information that can be linked to a specific individual. The HIPAA Safe Harbor method of de-identification lists 18 types of identifiers that must be removed, including names, dates other than year, contact details, and record numbers.<\/p>\n
In writing work, the risk is rarely a neat data table. It is free text:<\/p>\n
A label such as “de-identified” on a draft does not change what the text actually contains.<\/p>\n
This is the part writing teams most often miss. HHS guidance on cloud computing states that a cloud service provider that creates, receives, maintains, or transmits electronic PHI for a covered entity or business associate is itself a business associate. That holds even if the provider stores only encrypted data and has no way to view it.<\/p>\n
HHS also states that using such a provider without a business associate agreement (BAA) puts the covered entity or business associate in violation of the HIPAA Rules.<\/p>\n
So the practical question is not only whether a vendor stores your content. It is whether the vendor will sign a BAA if PHI may be in the draft. Short processing time or deletion after a session does not by itself settle that, so treat it as a question for your compliance team.<\/p>\n
A “HIPAA compliant” label is a claim. The documents behind it are the evidence.<\/p>\n