PathwayNotes is designed for clinical use where protected
health information may be involved. When a covered entity uses PathwayNotes
with PHI, HIPAA-related responsibilities are addressed through the PathwayNotes
Business Associate Agreement.
HIPAA refers to the federal law and related rules that
protect certain health information. PHI means Protected Health Information.
ePHI means Electronic Protected Health Information.
The BAA explains the responsibilities of PathwayNotes as
the Business Associate and the accepting provider or organization as the Covered
Entity. It covers permitted uses and disclosures of PHI, safeguards, breach
reporting, subcontractors, access and amendment support, termination, and data
export.
The BAA states that PathwayNotes uses reasonable and
appropriate safeguards, including encryption of ePHI in transit and at rest,
access controls, audit logging, workforce training, and a written information
security program.
Clinicians and practice administrators should review the
official BAA before using PathwayNotes with protected health information.