HIPAA-Friendly Note Taking Apps

Although Evernote incorporates some protection features that can prevent unauthorized access, the overall security controls aren’t likely sufficient to meet HIPAA standards.Evernote can only be used for medical data storage purposes if it’s completely offline and is going to stay offline. The computer that Evernote is set up on should be encrypted in order to prevent unauthorized personnel from accessing the information.

Grammarly states that it’s committed to security and privacy. The company lists 10 certifications and attestations on its website, including one for HIPAA. However, not all users can access features that enable HIPAA compliance.Potential users are asked to contact the Grammarly sales team about obtaining a Business Associate Agreement. If you dig further into the Privacy and Security section of the website, you’ll see that the company offers BAAs to those on Grammarly for Business Enterprise plans only. The website states that the organization is trying to “ramp up HIPAA support for…other customers.”

According to the company’s Help Center, Notion can be configured to enable HIPAA compliance; however, quite a few of its products are excluded from this type of use. The Notion website states that HIPAA features are available to customers on an Enterprise Plan with more than 100 members. Business Associate Agreements (BAA) are offered, but not all features are covered by the agreement. According to Notion’s FAQs about enabling HIPAA compliance, customers that need to use Notion for personal health information (PHI), should be aware of the the following limitations:Notion cannot be used to communicate with patients, plan members, their families, or employees.Users cannot include PHI in workspace or organization names, teamspace names, file names, account profiles, or user group names.Support requests can’t contain PHI.

Rocketbook enables users to upload their handwritten notes to the cloud. In most cases, notes aren’t stored on Rocketbook’s servers. However, this doesn’t mean that the app meets HIPAA requirements.According to its website, Rocketbook does not enable HIPAA compliance. There is currently no mention of Business Associate Agreements (BAA) on the website.

Apple Notes provides users with a fast and easy way to capture their thoughts or create lists and sketches, making it a convenient tool to collect information. The app also syncs across devices through Apple’s iCloud. It’s unknown whether Apple Notes enables HIPAA compliance.

OneNote may be HIPAA compliant, provided the right security features and configurations are used. Physical, technical, and administrative safeguards are available through Microsoft’s cloud services.These security and privacy measures help to prevent unauthorized access of electronic protected health information (PHI). Data stored on OneNote is encrypted, and Microsoft provides user access logs on request.Notes can be shared with other OneNote users through a network or internet connection. Because Microsoft OneNote offers multiuser collaboration, every participating device must meet all HIPAA compliance standards.Storing or sharing PHI on the software requires a signed business associate agreement (BAA) with the software provider. The BAA offers contractual assurances of HIPAA-compliant safeguards. Microsoft provides a BAA for many of its products, including OneNote.