HIPAA Adjacent Web Tool
To sum up my situation:
I’m launching a web-based documentation assistant geared towards PT, OT, and SLP therapists.
My service is designed to never handle any Private Health Information (PHI), but it does allow users to input customized templates. Therapy notes don’t contain PHI in the templates themselves, but I also can’t directly control what a user will put in.
I have built a PHI detector that will detect double surnames for top 1000 names in US census data and any suspicious strings of numbers (DOB,SSN, etc) which will prevent saving that information.
I have an indemnification clause and it’s all over the Terms and conditions that this tool is never designed to handle PHI.
There is no reason for them to input PHI, but I want to be covered if they do. Am I overplaying the risk here? Any advice in this situation?
.