Take the 2-minute tour ×
Healthcare IT Stack Exchange is a question and answer site for healthcare IT professionals and solution providers. It's 100% free, no registration required.

If I was a marketing firm who provides an analysis on visitor statistics from anonymous members who then ties that in to a CRM to track conversions, what do I have to do to the data to ensure that those customers information is handled properly according to HIPAA if the CRM database is on my portal separate from their website?

The application tracks visitors with tracking cookies. The application also uses tracking phone numbers to associate calls in to the businesses with the online visitors to determine offline conversions. Phone calls routed through the PBX create a new contact in the CRM and attach a recording of a call as well as a generated text transmission. These calls become associated with the anonymous visitor with the tracking cookie to determine the conversion source.

All of this information is gathered, sorted, and stored on our API server and the information can be pulled and viewed by our client purchasing these services through their account dashboard. I have just recently been introduced to HIPAA and I'm not familiar with what needs to be protected, and what doesn't have to be. I have been told that the fact that the customers of healthcare providers are contacting a healthcare provider needs to be protected.

I was curious as to whether or not the data needs to be obfuscated for our interaction with their account on their behalf among other things.


migrated to security.stackexchange.com by jonsca May 1 '12 at 11:09

This question belongs on our site for Information security professionals.

@Steve Buzonas... I cannot get a clear picture of what you are trying to do. Could you elaborate? Tell us how Private Health information is involved? Is it part of the CRM DB or is it a part of the visitor statistics gathered? –  John Hartsock Dec 28 '11 at 20:29
@JohnHartsock We aren't collecting the health information, we are just collecting the data from the customers we generate for them to be automatically populated in the CRM that we provide. –  Steve Buzonas Dec 28 '11 at 20:57
@Steve Buzonas... Then what would this have to do with HIPAA (Health Insurance Portability and Accountability Act)? –  John Hartsock Dec 28 '11 at 20:59
@JohnHartsock Part 1 is we gather demographics to target specific markets for campaigns. I believe all of the information we gather is "fair game" until we associate it with an individual. My understanding was that locations, phone numbers, etc were PHI and could not be used without implementing additional measures. Part 2 we take the information gathered and use it for statistics and reporting to the client, we also take this information and provide a gateway that our client can see all of their customers and all digital forms of communication: phone, email, website contact form, etc. –  Steve Buzonas Dec 28 '11 at 21:20
@SteveBuzonas You are taking HIPPA out of context. In general you should always protect personal information over the web. But this is not specific to HIPPA. –  John Hartsock Dec 28 '11 at 21:23