CiviCRM Community Forums (archive)

Can anyone speak to whether CiviCRM, Case, and/or Drupal are HIPPA (Health Information Privacy and Portability Act) compliant? Since the Physicians Health case study was developed in Canada, they may not have dealt with this, but every health (and quasi-health) care provider in the US has to. Google hasn't turned up much on this topic, except to say that Drupal's open API may make it too easy to gain access to patient/client health records. With the Obama Administration's interest in electronic health records, I think this question will come up a lot.
I'm implementing CiviCRM on Drupal for an advocacy group, but we are considering offering mentoring/coach services and it would be nice to do everything on one app. Thanks for any advice.

Here's my take on this.  Most of what HIPPA deals with has to do with the certification of the social system, not an IT system.   So to say that "Drupal isn't HIPPA compliant" I don't think makes sense.  You can only really say whether a particular organization's use of Drupal is HIPPA compliant or not.

On the information systems side, there are only a couple of "gotchas" with HIPPA.  They've adopted a few standardized vocabularies, all of which are ones that we intend to support in versions of CiviCase that are scheduled for release soon.  I suspect that with the recent interest from some US Physician Health Programs, we'll soon have an opportunity to demonstrate the HIPPA compliance of the CiviCase system.  At that point, it's a matter of other organizations looking at how we did it, and doing likewise.   

Most of what demonstrates HIPPA compliance is an ability to audit your past actions.  The one place where I can see this being a technical problem is that currently we don't track and log events where someone views a record.  We are already currently tracking and logging every instance where a record is edited, but don't track some other stuff, such as when record X was included in search results that were returned to user Y, and when user Y actually viewed record X.   I've proposed those as potential candidates for inclusion in CiviCase iteration 3.

The problem is, the commercial interests can afford to file comments and send people to advisory committee meetings where end-users and OS developers can not.

I think if OSS software developers/products work in silos, commercial interests can afford to do a lot more. However the beauty and power of OSS is the ability for groups to form of similar interests and passion. I think such groups can and do match up well to commercial interests in various meetings. Apache / Mozilla / Linux are good examples in various standard committees

lobo