A customer sends a screenshot to explain a bug. It contains a patient’s name and appointment details. Now that information may be sitting in your help desk, email notifications and chat integrations.
For a small healthcare SaaS team, this support workflow deserves its own controls. Protecting the main application is not enough if patient information is copied into tools that were never approved for it.
First, confirm your role
Selling to healthcare does not automatically make every vendor subject to HIPAA. Your role depends on the service and information involved. A software provider handling protected health information on behalf of a covered entity may be a business associate. Relevant subcontractors may be business associates too.
Have the responsible privacy or legal specialist confirm the arrangement. Where required, business associate agreements must cover the relevant relationships. A SOC 2 report does not replace those agreements or establish HIPAA compliance.
1. Give customers a safe way to show the problem
Example control wording: Support asks for a description without patient information first. If protected information is needed, staff direct the customer to the approved upload channel.
- Evidence to keep: The support instructions and approved-channel decision. Keep the case reference rather than copying the patient information into another tracker.
- Check: Follow attachments through notifications and integrations. An approved front door is not enough if copies go elsewhere.
2. Review the tools before they receive the data
Example control wording: The service owner reviews support tools and connected services before allowing protected health information into them.
- Evidence to keep: The review of the actual product and configuration. Record relevant agreements and who operates each safeguard.
- Check: A provider offering a BAA does not mean every product, feature or account plan is covered. Confirm the service you use.
HHS explains that even storing encrypted electronic protected health information without its key can make a cloud provider a business associate. Do not assume encryption removes the need to evaluate the relationship.
3. End temporary support access
Example control wording: Support access to a customer’s environment is limited to the authorized task and period. The team verifies removal when the work ends.
- Evidence to keep: The access approval and the system record of removal. Reference the support case.
- Check: Closing the support ticket is not evidence that permissions or active sessions ended.
4. Close out extra copies
Example control wording: Support handles temporary exports under the approved retention process. The case records their disposition or the reason they must be retained.
- Evidence to keep: A record of where the export was stored and what happened to it. Keep a reference to any approved retention exception.
- Check: Include downloads and connected tools. Do not promise immediate removal from every backup unless that is actually supported.
If information arrives in the wrong place
Limit further access and escalate through the privacy or security process. Establish where the information went. Follow the required assessment and reporting steps rather than assuming that deleting one attachment resolves the issue.
Sources
- HHS business associate guidance: applicability and contractual relationships.
- HHS cloud-computing guidance: cloud responsibilities and encrypted information.
These control examples illustrate one support workflow. They are not a complete HIPAA compliance program.