HIPAA Policy Change

Aric Edwards

Hello!

 

Originally, Smartsheet was set up as a HIPAA compliant item. Can anyone clarify when this changed and what justification caused this change? I have reached out to Smartsheet but they haven't gotten any feedback. Does anyone else know?

 

Thanks!

Tim McCarthy

Aric,

 

This is all I could find at https://www.smartsheet.com/security-info

 

HIPAA Statement

Under HIPAA, certain information about a person’s health or health care services is classified as Protected Health Information (PHI). Smartsheet customers who are subject to HIPAA are advised to refrain from storing PHI in Smartsheet. Smartsheet does not enter into Business Associate Agreements (BAA).

Questions? Concerns?

For information about other compliance frameworks such as FERPA, ITAR, or FedRAMP, please contact us at compliance@smartsheet.com. For more details about Smartsheet security, read our Security Policy, Security Whitepaper, and Privacy Policy. If you find a security issue with our product, please contact us at security@smartsheet.com or call us directly at 425-283-1870.

Travis

Thanks Tim for posting that! We have not changed our HIPAA policy - Smartsheet has never been HIPAA compliant. The information above will be your best reference and you can always email compliance@smartsheet.com for more information.

 

 

Aric Edwards

There was a very clear openness to HIPAA elements previously: https://www.smartsheet.com/customers/northeast-georgia-medical-center

http://www.medgadget.com/2014/09/smartsheet-cloud-based-collaboration-tool-helps-manage-acute-patients-interview.html

 

Was there perhaps a change in HIPAA policy that made Smartsheet shy away from promoting itself in such a manner or can you clarify how you have met the stringent HIPAA requirements of the hospital system?

 

 

Travis

Hi Aric, as mentioned in our HIPAA statement, Smartsheet does not recommend users store PII or PHI in Smartsheet. I am not able to say what information the linked company puts in their web form (because I do not know) but each company has their own set of security rules and regulations they comply with - its up to them to make the final decision about the data they are storing. 

Shaine Greenwood

Hello Aric,

At the time of this thread, Travis was 100% correct in that we were not HIPAA compliant, but I'm pleased to announce that we have made a recent change to that policy.

By entering in a business associate agreement (BAA) with Smartsheet and adhering to the Smartsheet HIPAA Implementation Guide, your organization can use Smartsheet in accordance with HIPAA.

To start the process of becoming HIPAA compliant with Smartsheet, please visit Smartsheet for Healthcare.