@scottalanmiller said:
@Dashrender said:
let's assume that it's provisionable/provisioned data - so what? I work for the company house/managing/maintaining the data, why can't I access it for the sake of security?
Because it is NOT your data, you DO NOT need it and it is against the law. The security to worry about here is IT getting data it does not have a right to see! The security breach here would be you.
The assumption of geo-security is an idea being pushed by IT, and to be useful would require a lot of HIPAA data that is not yours to use.
LOL! As a doctor, don't pay your hosted EMR bill then try to get YOUR data and see how that goes. I see this happen all the time. Vendors argue they cannot separate the intellectual property from the records without doing a "Conversion", which ends up costing tens of thousands depending on the system. You are basically paying an ETF for your contract because no conversion costs that much money.
This has nothing to do with ProjectSend tho. I do think the IP is good for tracking because it can show a trend or indicate unusual activity. Google does this with gmail and it works pretty well overall. If its required by HIPAA, I dont know. I doubt it specifically says you must tracking logins by IP. Chances are the legalese is much more generic like "The covered entity will make every reasonable effort to ensure only authorized users and or devices may be granted access to PHI" or something.