I'd really like to implement Google Analytics at my work on web software that is required to be HIPAA compliant. But I'm wondering if it's against the rules. Does anyone know how I can find out? I've searched Google, but there isn't much there on the subject. In the mean time I'm going to be reading up on HIPAA Privacy.
Our system is used to manage healthcare documents and PDFs. There's no specific patient information, but there is information relating to certain plans to a specific client/company might have. All we would like to do with Analytics is determine the browsers using our system, what documents are most frequently used and what times of the day we're the busiest. We have no intention of collecting any other information.
We would probably end up using custom event reporting as well.
Update: I'm going to do some more research, but wanted to post this link which was extremely helpful: http://www.hipaa.com/2009/09/hipaa-protected-health-information-what-does-phi-include/