The Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 HIPAA provides for the U.S. Department of Health and Human Services to promulgate standards governing the privacy and security of certain individually identifiable health information. HIPAA was most significantly amended by the Health Information Technology Act for Economic and Clinical Health Act of 2009 the HITECH Act which added breach notification requirements and expanded the scope of who is governed by HIPAA. The HIPAA Privacy, Security, and Breach Notification Rules establish important protections for individually identifiable health information called protected health information or PHI when created, received, maintained, or transmitted by a HIPAA covered entity or business associate. A Covered Entity is a health care provider, health plan, or a health care clearinghouse. A Business Associate is an entity or person, other than a member of the workforce of a covered entity, who performs functions or activities on behalf of, or provides certain services to, a Covered Entity that involves creating, receiving, maintaining, or transmitting PHI.
The HIPAA Privacy and Security Rules require that a Covered Entity obtain written assurances from a Business Associate in the form of a Business Associate Agreement, or BAA, requiring the Business Associate to safeguard the privacy and security of the Covered Entitys PHI.
Providing PHI to Adobe
Adobe provides health care customers with services that are ready to accept PHI, referring to these services as HIPAA-Ready Services. These HIPAA-Ready Services have additional features and functionalities that allow for both customers, who are Covered Entities or Business Associates, and Adobe to comply with their respective HIPAA obligations. These additional features may increase your license or subscription costs.
Customers that license HIPAA-Ready Services to process PHI must have a BAA with Adobe that applies to those HIPAA-Ready Services. A customer may provide PHI only with a HIPAA-Ready Service, in accordance with the license agreement and BAA between Adobe and the customer. Customers are not permitted to create, receive, maintain, or transmit PHI through Adobe Products and Services that are not HIPAA-Ready Services because Adobe has not designed these services to support the customer and Adobes HIPAA compliance.
← Back to Certifications