Standards to follow to be HIPAA Compliant

[jweek]

As a developer thinking about contributing to OpenDental, I am wondering what the criteria is when developing software used in the healthcare industry to ensure it is HIPAA compliant. Does OpenDental have a standards document, which other developers can follow to ensure any changes/features they add will be HIPAA compliant? Any and all information would be greatly appreciated!

Thanks,

Joshua

[jordansparks]

Not really. This is handled on an individual basis. Many HIPAA issues are outside the scope of programming, such as ensuring a secure network and staff awareness of privacy. The HIPAA rules tend to be general and unspecific. We constantly attempt to identify weaknesses in privacy and security and improve them. We're not bureaucratic enough yet to be formalizing all that complexity into a document. Current issues under consideration include:
-Encrypting email.
-Restricting printing of SSN on claimforms.
-Encrypting SSN in database.
-Improving built-in backup features.
-Limiting staff access to certain data under certain conditions.

I don't think a programmer could really make Open Dental less HIPAA compliant. Especially since we require discussion of all new features before adding.