HIPAA-Friendly Team Collaboration Tools

There is no mention of HIPAA or Business Associate Agreements on the Teams homepage; however, a support article on the Microsoft website states that Teams is Tier-D compliant with HIPAA standards. As with Office 365, this basically means as long as users are on the right Microsoft plan, follow the appropriate practices, and sign a Microsoft Business Associate Agreement (BAA), the platform can be used in a way that complies with HIPAA regulations.In order to enable HIPAA compliance for Office 365, users must be on one of the following plans: Microsoft 365 Business Premium, Microsoft 365 Business Essentials, Office 365 E3, Microsoft 365 E3, Office 365 E5, or Microsoft 365 E5.

FaceTime isn’t designed to be used as a telecommunications tool in a healthcare setting.

For HIPAA compliance, users need to purchase a paid plan for G Suite, purchase Google Voice, and sign the G Suite BAA.

eFax is an electronic faxing solution that uses advanced security protocols to make sure ePHI is secure both during transmission and in storage. eFax is known as one of the most secure online fax providers.eFax uses unique user identification and 256-bit SSL encryption to ensure secure document transmission and keep ePHI safe from unauthorized access. eFax also offers secure transport layer security (TLS) encryption protocol, administration privileges to limit access to ePHI, and multilevel audit controls, including secure and automatic fax archiving. Fax transmissions are stored on the eFax cloud and kept safe in Tier III secure servers.

Qualtrics calls its platform an “industry leader in security.” Among the many certifications it lists on its website is Health Information Trust Alliance (HITRUST). The HITRUST framework helps organizations demonstrate compliance with HIPAA and HITECH regulations. Qualtrics claims to be the only experience management platform that’s HITRUST certified. Though there is no mention of a Business Associate Agreement on the Qualtrics website, a sample Qualtrics Contractor Business Associate Agreement can be found through a Google search.

According to the platform’s online knowledge base, customers with 25 or more users on a monday.com Enterprise plan have access to features that enable HIPAA compliance. But if a customer changes to a different plan, they will no longer have access to HIPAA compliance features.Customers must accept the conditions of the Business Associate Agreement (BAA) and configure their account for HIPAA. The full BAA for HIPAA compliance is online, with step-by-step instructions on how to complete it.

Metrofax offers secure, encrypted fax communication services. The built-in faxing features allow users to quickly send information from a cell phone or computer as a fax.Even though Metrofax provides encryption to protect transmitted information, it appears to be missing some capabilities required for HIPAA compliance. When sharing PHI through a third-party provider, HIPAA regulations require a signed Business Associate Agreement. This BAA must be in place for Metrofax’s services to meet HIPAA compliance.Check with Metrofax to see if they will sign a BAA.

Teamviewer states that it is a HIPAA-friendly remote access solution that allows users to access devices no matter where they are. Security is a key objective for Teamviewer. The company has received multiple security certifications from A-LIGN, a provider that helps businesses implement HIPAA security features.All of Teamviewer’s remote support, remote access, and online collaboration features maintain privacy and security. This includes end-to-end encryption, which is why many companies trust Teamviewer.HIPAA has strict standards for the privacy and confidentiality of patient information. When using computers, networks, and mobile devices for PHI, all access and management must follow HIPAA regulations. Additionally, every employee must receive regular HIPAA training. Teamviewer’s security and privacy practices appear to meet HIPAA standards.Before using Teamviewer with PHI, you must get a signed BAA from the company. Submit an inquiry to Teamviewer customer service for assistance in obtaining the BAA. A signed BAA might be available only for organizations that meet a specific spending threshold.

Jira is one of several products offered by software company Atlassian. Among the features spotlighted on the Jira web page are world-class security and compliance. Atlassian claims that it provides comprehensive privacy and security protections that enable customers to operate its products, including Jira, in compliance with HIPAA. This includes security measures to protect PHI; assessments; an annual HIPAA security attestation, gap assessment, and security risk analysis; and regular review of HIPAA policies and procedures.Per the Jira website, customers who purchase the Standard, Premium, or Enterprise Plan for Jira can enter into a Business Associate Agreement (BAA) with Atlassian.

Sharepoint has stated that it provides necessary administrative and technical features to meet HIPAA requirements. Some of these features include access control for users, audit control, logs, and encryption. Threat awareness resources make it easy to access real-time reports about information access and usage.Sharepoint is a Microsoft service. The Microsoft website states that Sharepoint online enables HIPAA compliance when paired with Office 365 Enterprise. While Microsoft ensures it meets its responsibilities as a business associate, users are responsible for configuring the platform correctly.A variety of security add-ons are included for Office 365 Enterprise users, such as advanced threat protection, security management, advanced compliance, and threat intelligence. Licensing includes anti-malware, Windows Defender, Cloud App Security (CAS), Azure AD Identity Protection, Azure Security Center, Azure Advanced Threat Protection, and more.If you configure and use Sharepoint correctly, this service can be a HIPAA-friendly solution for information storage, management, and collaboration.

Trello is one of several products offered by software company Atlassian. While there is no mention of HIPAA on Trello’s main website, Atlassian Support offers a HIPAA Implementation Guide and an article to further explain HIPAA compliance for Atlassian products. The Implementation Guide states that Atlassian will enter into a Business Associate Agreement for eligible products; however, Trello is not on that list of products.

To get a clear picture of whether or not ClickUp enables HIPAA compliance, you have to pay attention to detail. The website states that the platform is HIPAA compliant only if you purchase the Enterprise plan. Business Associate Agreements (BAAs) are only issued to Enterprise users. Customers on any of the other three ClickUp plans do not have access to HIPAA compliance features.

Grasshopper’s website states that it does not enable HIPAA compliance and that support team members have access to account information and settings to help with technical issues. This access includes all messages that pass through Grasshopper’s calling, texting, and faxing features.If protected health information (PHI) passes through these communication tools, it appears possible that unauthorized individuals could access the information. If Grasshopper doesn’t offer HIPAA-friendly services, covered entities shouldn’t use these tools.

Many telecommunications firms act as conduits for data transmission and are exempt from signing a business associate agreement (BAA) through the conduit exception rule. Information shared over the phone or using a standard fax machine is not subject to HIPAA compliance. However, other means of communication, including VOIP, SMS, and digital fax services, must meet HIPAA regulations.HelloFax provides AES-256-bit encryption for information at rest and TLS encryption for information in transit, to meet the minimum HIPAA standards. Additionally, each document is encrypted with a unique key, and keys are encrypted with a master key that rotates frequently, which means that if unauthorized people gained access to the hard drive, they wouldn’t be able to decrypt the data.HelloFax advertises “bank-grade” security, including physical and electronic protections. The data center apparently uses strict access controls. Because of these security measures, it may be possible to use the HelloFax system without violating HIPAA requirements.

There is no mention of HIPAA on the Basecamp website. Basecamp is designed, built, and backed by 37signals. The 37signals Security Overview page doesn’t address HIPAA compliance either. Business Associate Agreements (BAAs) are not mentioned on either site.

MyFax offers a variety of security and privacy features, but it isn’t clear from the website whether this service meets HIPAA requirements. The privacy features of this digital faxing service are more robust than traditional fax machines, but they may not be sufficient for protecting health information.The company J2 Global owns both MyFax and eFax. These platforms are similar, but there are notable differences in privacy, security, and faxing capabilities. MyFax suggests that covered entities use services from its partner, eFax Corporate.

LogMeIn is remote-access software. Covered entities using this tool must implement protections to prevent unauthorized access of protected health information (PHI). HIPAA compliance requires strict measures for access control, including unique user identification, emergency access procedures, automatic logoff features, person authentication, and audit controls. LogMeIn customers should adjust specific account settings before using the service with PHI.LogMeIn also offers transmission security that may meet HIPAA requirements. All data transmitted during chat, remote-access, or file-transfer sessions is protected with 128-bit encryption at minimum. When permitted by the encryption level on the client’s browser, the protection increases to 256-bit encryption.To support customers in meeting HIPAA requirements, LogMeIn provides a detailed outline of considerations and setting recommendations. These technical safeguards and transmission security features may enable covered entities to maintain compliance with HIPAA’s Privacy and Security Rules.

Quickbase states on its website that the platform “enables its customers to build applications compliant with the HIPAA Security Rule.” The company points out that customers are responsible for determining whether they are covered entities or business associates, if a Business Associate Agreement (BAA) is required, and for ensuring their company uses Quickbase in compliance with all HIPAA requirements.Quickbase will sign BAAs with business and enterprise customers that have an annual or multiyear contract. 

Quip, a cloud-based collaboration tool, uses innovative security controls and measures that appear to align with HIPAA compliance requirements. The system is fully encrypted and offers a variety of customizable privacy options to meet each organization’s unique compliance requirements.Covered entities often pair Quip Shield with Salesforce to take their security to the next level. The combination allows users to collaborate using Salesforce data in a central space while their data is protected with critical security measures such as permissions, version history, and encryption.These cloud-based tools offer security for protected health information (PHI), with technical, physical, and administrative safeguards designed to maintain compliance. Covered entities can build healthcare applications through Salesforce, knowing that Quip provides the security measures intended to protect PHI.Quip has features that allow for data control and audits. Users can tailor the Quip platform based on their unique compliance and security needs. Key security features of Quip Shield include encryption of data in transit and at rest, granular administrative controls, access management, antivirus scanning, and real-time event logging. The option of a private, single-tenant cloud allows for better control of the network, including limits on geographical access.