CiviCRM Community Forums (archive)

Well, that's not exactly the question that should be asked. Rather, can CiviCRM and its CiviCase component store patient information in way that would make it eligible to be used in an organization that needs to be HIPAA compliant?

http://searchsecurity.techtarget.com/generic/0,295582,sid14_gci1075697,00.html does not seem to pose any significant issues, though I'm concerned about the potential benefit of encryption in case of data loss.

It seems that small outfits may not have to high end systems: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

The contact anonymization features seem like they would be useful in a certification or audit.

Reviewing the minimum necessary compliance requirements for privacy at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalusesanddisclosures.html it appears to me that CiviCRM easily clears the required threshold.

Has this every come up anywhere? Has any organization tried and succeeded or failed in being certified as HIPAA compliant while using CiviCRM?

Seems like a potential big market.