HIPAA and EnableX

What is HIPAA

HIPAA (Health Insurance Portability and Accountability Act of 1996) is United States legislation that provides data privacy and security provisions for safeguarding medical information. More information on HIPAA is available on Wikipedia.

It provides standards to protect the confidentiality, integrity, and availability of protected health information (PHI), including electronic protected health information (ePHI).

HIPAA is divided into two separate rules that work in conjunction with each other to ensure maximum protection: the Security Rule and the Privacy Rule.

• The Security Rule establishes national standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity. It requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.
• The Privacy Rule revolves around the individual and their rights to have control over the way their sensitive data is used. Aside from this, the data must remain confidential. This Rule sets national standards for the protection of individually identifiable health information by three types of covered entities: health plans, health care clearinghouses, and health care providers who conduct the standard health care transactions electronically.

Roles and Responsibilities of Various Entities in HIPAA

The HIPAA Rules apply to covered entities and business associates.

Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules’ requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information. EnableX is designed so that PHI need not be stored on or pass through the platform, so a Business Associate Agreement is typically not required. Where a specific deployment does involve PHI on the platform, contact EnableX to discuss the appropriate arrangements.

HIPAA and the EnableX Platform

EnableX has been designed such that healthcare providers and other covered entities may use our services for video communication in a manner that is consistent with their HIPAA obligations.

• The real-time communication platform does not need to store PHI to deliver a session. Where you enable recording, transcription or AI agent features, the resulting recordings, transcripts and knowledge-base content are processed on your instructions and can be hosted in a region of your choice or fully on-premise.
• The media communication in a session happens over an encrypted channel:
  1. Secured tokens are used for session establishment.
  2. Random AES keys are generated by clients at the beginning of the media connection.
  3. Data transmission and encryption: Transport Layer Security (TLS) is used to encrypt both voice and video data. The core protocols used are SRTP for media traffic encryption and DTLS-SRTP for key negotiation, both of which are defined by the IETF. The endpoints use AES cipher with 128-bit keys to encrypt audio and video, and HMAC-SHA1 to verify data integrity.
• Live session audio, video and text are not retained once the session ends unless you enable recording, transcription or AI agent features, in which case you control retention, deletion and hosting location.
• Any personal information that the user enters in the application is not shared with the platform.
• If the recording feature is used, the platform API and portal allow the application developer the flexibility to manage, delete, or associate specific rules to manage the recorded file. The application developer can choose to move the recorded file immediately after its creation over an encrypted channel and force-delete the file from the EnableX server.
• EnableX does not auto-create or store any copy of the session recording. Recording can be initiated only by the application, and the rights and permissions to initiate or manage the recording feature are managed at the application layer.
• EnableX is hosted behind a protected firewall and all components communicate over a private VLAN not exposed outside to help protect against intrusion.
• Edge filtering and advanced routing techniques help protect against Distributed Denial of Service (DDoS) attacks.

How to Build Your HIPAA-Compliant Application Using the EnableX Platform

The platform is used across a large number of industry verticals, such as healthcare and banking, which have stringent security requirements. To ensure that applications hosted on EnableX are compliant, the platform provides different deployment models (private, public, hybrid, on-premise), provides APIs to query or delete any customer-specific data stored on the platform (i.e., session recordings), does not store any end-customer data on its platform, and provides full control (read, modify, delete) over application data passed via the application to the platform.

EnableX platform provides you with all tools to have control over your application data; the application developer is responsible for ensuring that the final application is developed in compliance with HIPAA. A Business Associate Agreement (BAA) is available for deployments that process PHI; contact us to put one in place.

Below are our recommendations to consider when building applications according to HIPAA requirements.

• Keep your API key secure and safe.
• When possible, use ad-hoc rooms and create one token per participant.
• Use an anonymous identifier to mask customer data for token generation. Do not share customer information in the encrypted token with EnableX.
• Delete recorded content after transfer to your application storage area.
• Limit the maximum number of users who can join the session.
• Users join the room with a participant role, and only allow the moderator role to assign privileges to selected users to be able to record the session.