MICROSOFT OFFICE 365 FOR STUDENTS Students can now store and share HIPAA data using Microsoft Office 365 services, but not email. What changed? BU students who are a covered component workforce member can now request a Microsoft Office 365 account (“O365 account”). Every Henry M. Goldman School of Dental Medicine student will shortly be given an O365 account. Other covered component students can request an O365 account from their HIPAA contact (). What did not change? We must still use Data Motion to communicate with patients and send patient data by email. Emails sent to a BU email address (i.e., name@bu.edu) are not encrypted. Therefore, we must still use Data Motion to send patient data or to communicate with patients. We have a HIPAA business associate agreement (BAA) with Data Motion, and Data Motion encrypts every email. Google services, such as Gmail and Google Drive, can never be used to store or share HIPAA data. BU has a BAA with Microsoft covering O365 services, but BU does not have a BAA with Google. Approved storage options can be found here: . What if a patient does not want to communicate Data Motion? We are required by HIPAA and BU Policy to communicate with patients using Data Motion. However, patients do have a right to request alternate communications (unsecure email). When a patient does make this request, we must have documentation of the patient accepting the risk of unsecure email. Check out the July 2017 HIPAA Security Reminder for more information: . Have questions? Contact IT Support Contact your BU HIPAA Security Rule Officer, David Corbett, at
MICROSOFT OFFICE 365 FOR STUDENTS Students can now store and share HIPAA data using Microsoft Office 365 services, but not email. What changed? BU students who are a covered component workforce member can now request a Microsoft Office 365 account (“O365 account”). Every Henry M. Goldman School of Dental Medicine student will shortly be given an O365 account. Other covered component students can request an O365 account from their HIPAA contact (). What did not change? We must still use Data Motion to communicate with patients and send patient data by email. Emails sent to a BU email address (i.e., name@bu.edu) are not encrypted. Therefore, we must still use Data Motion to send patient data or to communicate with patients. We have a HIPAA business associate agreement (BAA) with Data Motion, and Data Motion encrypts every email. Google services, such as Gmail and Google Drive, can never be used to store or share HIPAA data. BU has a BAA with Microsoft covering O365 services, but BU does not have a BAA with Google. Approved storage options can be found here: . What if a patient does not want to communicate Data Motion? We are required by HIPAA and BU Policy to communicate with patients using Data Motion. However, patients do have a right to request alternate communications (unsecure email). When a patient does make this request, we must have documentation of the patient accepting the risk of unsecure email. Check out the July 2017 HIPAA Security Reminder for more information: . Have questions? Contact IT Support Contact your BU HIPAA Security Rule Officer, David Corbett, at