HIPAA & health data

HIPAA is the United States law that protects patients' health information. The CareWays Collaborative network brings together institutions from several countries, so we use HIPAA's privacy and security rules as a reference and apply them alongside each country's data protection law.

HIPAA has no official certification process. This page is not a compliance seal: it describes the safeguards the platform applies today.

If your institution is subject to HIPAA and needs a Business Associate Agreement (BAA) or another data processing agreement, contact us before recording patients.

The registry collects the variables needed to compute PIM3 and the network's quality indicators: admission and discharge data, physiological variables, diagnoses, interventions, events during the stay and outcome.

Only clinicians authorized by their institution record patients. Analyses shared with the network are aggregated and do not identify any patient.

We apply the principle of least privilege:

• A new account can only reach the clinical modules after verifying its email and being approved by a network lead.
• Each clinician sees the patients of the institution and unit they are assigned to; the network's coordination and analysis roles have a broader scope in line with their function.
• Permissions are checked on the server on every request, not just in the interface.
• Only network administrators can change a user's role or institution.

Among other measures:

• All communication is encrypted (HTTPS) and the session uses a signed cookie that page scripts cannot read.
• Passwords are stored as hashes, never in plain text.
• Critical changes to a patient (discharge, deletion or a change to their confidentiality level) are written to an audit log: who did it, when and what changed.
• That log is fed from the database itself, so it records the change even if it was not made through the platform. Sensitive administrative actions, such as profile impersonation and password resets, are logged too.
• Deletions are logical: the patient's history is kept for traceability.

We use product analytics to improve the platform, but on the clinical registry screens no clicks or text are captured, session recording is turned off and URLs are sent without patient identifiers.

That way we know someone used the registry, but not which patient they looked at.

Practice mode (sandbox) uses fictitious patients to train people on the registry. Its data is stored separately from real data and is not included in the network's indicators. Real patients must not be recorded there.

Each participating institution remains responsible for its patients' data. It is responsible for:

• Having the legal basis to record its patients, such as consent or ethics committee approval, according to its regulations.
• Deciding which clinicians record data and telling us when someone leaves the institution so their access can be removed.
• Making sure its team does not post data that identifies a patient outside the registry, for example in the forums.
• Notifying us promptly of any suspected unauthorized access.

If we detect unauthorized access to patient data, we investigate it using the audit log, contain it and notify the affected institutions without undue delay so they can meet their own notification obligations.

For questions about health data protection, requests for data processing agreements or security reports, write to us through the site's contact form.