If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that those customers information is handled properly according to HIPAA if the CRM database is on my portal separate from their website?
The application tracks visitors with tracking cookies. The application also uses tracking phone numbers to associate calls in to the businesses with the online visitors to determine offline conversions. Phone calls routed through the PBX create a new contact in the CRM and attach a recording of a call as well as a generated text transmission. These calls become associated with the anonymous visitor with the tracking cookie to determine the conversion source.
All of this information is gathered, sorted, and stored on our API server and the information can be pulled and viewed by our client purchasing these services through their account dashboard. I have just recently been introduced to HIPAA and I'm not familiar with what needs to be protected, and what doesn't have to be. I have been told that the fact that the customers of healthcare providers are contacting a healthcare provider needs to be protected.
I was curious as to whether or not the data needs to be obfuscated for our interaction with their account on their behalf among other things.