UW–Madison and UW Health Software and Services for Exchanging and Storing Protected Health Information
Before using this list, please read the following:
- This is a list of commonly used software and services authorized for use with protected health information (PHI) along with some commonly available software and services prohibited for use with PHI.
- All approved items have been evaluated by HIPAA privacy and security compliance staff, so no further review is needed.
- This is not intended to be an exhaustive list of every software or service available for use with PHI.
- These items must be used in compliance with relevant guidance.
- They must be used with computers and devices issued or managed by UW Health or UW–Madison (i.e. not personally owned devices)
- Hyperlinks are provided for items that require additional steps before use.
- Please direct any questions regarding use of these items or options for approved remote access to the UW Health Security Team (via UW Health’s Service Desk at 265-7777), or to UW–Madison HIPAA Security Coordinators.
- You may use software or services not listed here, but the following steps must first be completed. Completing these steps often causes project delays, and it may not be possible to successfully complete the steps in all cases:
- Security assessment (vendor participation required)
- Execution of appropriate HIPAA agreements between UW and the vendor (typically includes a Business Associate Agreement)
UW–Madison Software and Services
|
- Amazon Web Service (AWS)
- Cisco Webex Meetings, & Webex Teams, & Calls
- CloudFax
- Electronic health record systems for UHS and Athletics
- Electronic Lab Notebook
- Enterprise Content Management Service (ECMS) Imaging
- Globus
- Google Cloud Platform (Not Google Workspace)
- Institutional Shared Network Drives
- Microsoft Office 365 work-issued email (when used in compliance with UW–Madison policy)
- Microsoft Teams (audio and video only)
- Phone calls using UW–Madison-provided mobile devices and landlines
- Platform R
- Platform X
- Premium Business Services
- Qualtrics
- REDCap (WISC and FDA Regulated instances only. Before using any other instance, contact your unit’s HIPAA Security Coordinator)
- Research databases or registries provided by study sponsors or collaborators
- Research Drive
- Secure Box Folders (Not standard-issue Box Folders)
- Secure Zoom, including Zoom AI companion (Confirm enrollment & enroll)
If you become aware that any of the following items have been used with PHI, submit a HIPAA Incident Report as soon as possible.
- AI tools not approved for use with PHI
- Canvas
- Google Workspace (e.g. Drive, Docs, Sheets, Slides, Calendar)
- Microsoft Office 365 Calendar Entries
- Paging
- Personally acquired software or services
- SharePoint (UW–Madison instance)
- Social Media (Unless specifically approved as part of an IRB protocol or University-endorsed publicity campaign)
- Texting (Unless specifically approved as part of an IRB protocol)
- Other Apps, Software, Tools from Cloud Service Providers not reviewed and approved by UW Health or UW–Madison
UW Health Software and Services
|
- Health Link
- Health Link InBasket Messaging
- Epic Haiku (iOS or Android) and Epic Canto (for iPads)
- Epic Secure Chat
- MyChart (Ambulatory)
- MyChart Bedside (Inpatient)
- Cisco Webex (Meetings and Chat)
- SharePoint
- uwhealth.org or uConnect Website Forms
- For delivery of UW Health Clinical Telehealth Services to Patients, MyChart Video Visits, Vidyo, AmWell, and WebEx (limited cases)*
- For other calls, VoIP Phone Services used with devices provided or managed by UW Health or UW–Madison
*Staff who provide telehealth services at UW Health or any other healthcare facility must follow the policies and guidance for provision of telehealth to patients at each facility.
- UW Health’s internal web paging system
- Well SMS/Text Messaging platform which uses automated protocols for one-directional communication
- Patients or family members must opt in
- Patients or family members must not be able to respond
- Must be approved by UW Health Privacy Officer on a case-by-case basis
- Institutional Shared Network Drives
- Should not be used to store duplicative or “shadow” copies of Health Link or Enterprise Data Warehouse data
- Store sensitive and restricted data types in a “SpecialShares” folder with limited permissions.
- Microsoft Office 365 work issued email (generally ending in uwhealth.org)
- RightFax enables inbound and outbound faxing using the RightFax application. Some outbound workflows are integrated with other applications, like Health Link, to facilitate electronic signatures on documents.
- To learn more or convert a physical fax machine to a RightFax queue, contact the UW Health Help Desk at 265-7777
- Verify fax number
- Use Cover Sheet
- Only use institutionally-provided vendors and institutionally-provided fax equipment
- Do not use other electronic fax services like Doximity, eFax or other services
If you become aware any of the following items have been used with PHI, submit a HIPAA incident report as soon as possible to UW Health.
- Personally acquired software or tools (e.g.: email accounts, file-sharing accounts, and instant messaging accounts)
- Microsoft Office 365 – Calendar Entries with PHI
- Canvas (UW–Madison’s Web-based Course Delivery Platform)
- G-Suite/Workspace (Google) Tools (Gmail, Drive, Docs, Sheets, Slides, Forms, Calendar, Google+, Hangouts)
- Social Media (Facebook, Twitter, Instagram, Snapchat)
- **In some situations, an IRB may approve a research protocol involving the use of social media; if so, social media may only be used as stated in the approved protocol
- Other Organizations’ Text or Web Paging Systems (Text pages should not include patient/subject identifiers)
- Texting
- Virtual Assistants (Alexa, Echo Dot, Siri, Bixby, Alice)
- VoIP Phone Services not provided by UW Health or UW–Madison (Google Voice, WhatsApp)
- Other Apps, Software, Tools from Cloud Service Providers (e.g.: Slack, and ZendTo) not reviewed and approved by UW Health or UW–Madison