HIPAA Compliance

Access Control. A regulated entity must implement technical policies and procedures for its electronic information systems that maintain ePHI to allow only authorized persons to access ePHI.

COMPLIANT

• Role-based access controls (RBAC) and group-based access controls (GBAC) are implemented in Expertflow CX so that only authorized Agents can access the application. For more details see Agent Authorization with Agent Desk

• To protect patients’ personal information, we offer the PII data masking features:

  • PII data masking in logs

  • PII data masking in AgentDesk

Authentication. A regulated entity must implement procedures to verify that a person seeking access to ePHI is who they say they are.

COMPLIANT

All agents must authenticate themselves to use Expertflow CX, also as an added layer of security Two-factor authentication can be used as a second form of verification. For more details see Identity and Access Management.

Transmission Security. A regulated entity must implement technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic network.

COMPLIANT

Expertflow CX uses TLS for secure communication. See Data Encryption for details.

Audit Controls. A regulated entity must implement hardware, software, and/or procedural mechanisms to record and examine activity in information systems that contain or use ePHI.

A regulated entity must implement policies and procedures to ensure that ePHI is not improperly altered or destroyed. Electronic measures must be put in place to confirm that ePHI has not been improperly altered or destroyed.

NON-COMPLIANT

A centralized Audit-logging is on the roadmap for 2025.