This guide is a general summary and is not intended as legal advice. For guidance specific to your practice, consult a legal professional or your regulatory body.
Is Jane HIPAA compliant?
Yes, Jane is compliant with the Health Insurance Portability and Accountability Act (HIPAA).
Does HIPAA apply to my clinic?
HIPAA (the Health Insurance Portability and Accountability Act of 1996) is U.S. federal legislation that governs how Protected Health Information (PHI) is collected, stored, used, and disclosed. Compliance is required for any organization that stores PHI in the United States, including allied health clinics.
HIPAA is organized into two key rules:
- Privacy Rule: Defines what counts as PHI and sets out the requirements for how it can be used and disclosed.
- Security Rule: Sets out the safeguards required to protect electronic PHI (ePHI).
Where state law is more stringent than HIPAA, state law applies. Where it is less stringent, HIPAA applies.
If you're unsure whether HIPAA applies to your organization, contact your regulatory body for guidance.
What are my responsibilities under HIPAA?
The Privacy Rule defines PHI broadly as medical records and other individually identifiable health information held by a covered entity. This can be information that relates to health status, the provision of healthcare, or payment for healthcare and can be used to identify an individual. In a clinic context, this includes:
- Patient names and dates associated with an individual
- Contact information (phone, email, fax)
- Social security, medical record, health plan, or account numbers
- Driver's license numbers or vehicle identifiers
- Device identifiers, IP addresses, and web URLs
- Biometric identifiers (fingerprints, retinal scans)
- Full-face photos or comparable images
- Geographic data smaller than a state level (such as a city)
Information that isn't identifiable on its own can become PHI if it's combined with other pieces of information that, when together, can identify a person.
With this context in mind, here are the core principles and rules of the HIPAA Privacy Rule:
- Protection of PHI: information should be protected through safeguards, regardless of format (i.e. paper, electronic, and oral formats).
- Permitted Uses and Disclosures (TPO): this principle allows healthcare providers to share data without direct, written authorization from patients if fulfilling the purposes of providing treatment (T), managing payment (P), and managing healthcare operations (O).
- Minimum Necessary Standard: organizations must make reasonable efforts to limit use, disclosure and requests for PHI to the minimum necessary to accomplish the intended purpose.
- Patient Rights: individuals whose information you collect have the right to view and receive copies of medical records; to request corrections; to receive notice of how their data is being used; to restrict disclosures; and to an accounting of disclosures (i.e. a log that shows disclosures outside of TPO).
- Authorization Requirement: explicit, written permission is required from patients for any data sharing which falls outside of standard care, payment, operations, or legal exceptions (e.g., marketing purposes).
📣 Heads up: we're likely to see amendments to HIPAA by the end of 2026 or in early 2027. We'd highly recommend monitoring for changes (as we will be too!).
How does Jane enable my compliance with HIPAA?
Jane's platform is built with administrative, physical, and technical safeguards to support your compliance under HIPAA's Security Rule.
The information below is not exhaustive. It illustrates some of the safeguards Jane has in place to support you, and more information is available on our Security and Trust page.
Administrative safeguards
Jane's support staff can access your account data only when you request assistance. All employees sign confidentiality agreements and complete privacy training. Chart access is limited to senior managers, and other support staff cannot view your medical data.
Physical safeguards
Jane stores data in SOC 2 audited and compliant data centers with current security, authorization, and surveillance controls.
Technical safeguards
Data in transit between Jane's servers and your browser is encrypted with 128-bit encryption. Data stored on Jane's servers uses 256-bit encryption, the same standard used by banks. Jane requires each clinic staff member to have their own account, and you control permissions for each staff member. Access to information within your account is logged for your review.
Signing a Business Associate Agreement (BAA)
As a covered entity, you'll want to sign a Business Associate Agreement (BAA) with Jane, or any other Business Associates you work with. To request one from us or receive a copy of your signed BAA, reach out to [email protected].
Have questions about this guide or anything else related to privacy? Email Privacy and Security Support at [email protected].