HIPAA & Healthcare Data
The assessment, agreement and safeguards needed before using a MigiHub deployment for HIPAA-regulated health information.
On this page
1. Confirm the use case before sharing PHI
HIPAA and HITECH obligations depend on the parties’ roles and the information involved. MigiHub can be evaluated for healthcare-related scheduling and service workflows, but a general subscription or this notice is not approval to upload protected health information (“PHI”).
Before processing PHI, confirm the covered services, deployment, permitted integrations, security requirements and an applicable executed Business Associate Agreement (“BAA”) with InnuCloud. A Canadian organization’s healthcare obligations may also arise under other privacy laws.
2. Roles and contractual coverage
Where the legal definition is met, InnuCloud acts as a business associate, or subcontractor business associate, for PHI processed on behalf of a covered entity or another business associate. The BAA defines permitted uses, disclosures, safeguards, reporting and return/deletion obligations.
InnuCloud’s own website and ordinary commercial-administration activities are assessed separately. A provider’s BAA or cloud compliance documentation does not automatically cover every MigiHub workflow or external integration.
3. Minimum necessary information
A booking, patient-linked contact, appointment location, attachment or timesheet may contain PHI depending on its context. Avoid diagnoses, clinical records, government identifiers and unnecessary patient details in free text or notifications. Use reference codes and restricted fields where appropriate.
De-identification requires a recognized method when claimed under HIPAA. Removing a name alone is not sufficient. Assess Safe Harbor or Expert Determination requirements before treating a dataset as de-identified.
4. Safeguards and shared responsibilities
The assessment covers unique user identification, least-privilege roles, SSO and authentication options, encryption, audit trails, monitoring, backup/recovery, incident response and vulnerability management. Exact controls and responsibilities are documented for the covered deployment.
The customer manages authorized users, workforce training, its own risk analysis, lawful disclosure and retention. Relevant subcontractors handling PHI require appropriate downstream terms. Optional messaging, video, AI or other third-party connections must be assessed before PHI is shared with them.
5. Incidents and assurance
When acting as a business associate, InnuCloud reports incidents and breaches as required by the BAA and applicable law, without unreasonable delay, and provides available details to support the customer’s assessment and notifications. The BAA specifies operational reporting requirements.
HHS does not endorse private “HIPAA certification” as proof of compliance. Meaningful assurance depends on the BAA, risk analysis, documented safeguards and ongoing operation. Contact info@innucloud.com to discuss the intended use before sharing PHI.