3.4 3.4 3.5 3.5 Security Security Security Security for for for for Data Data Data Data in in at at Transit Transit Rest Rest 1 1 SHALL PHI PHI PHI PHI and and and and PII PII PII PII stored stored transmitted transmitted on on a a smartphone smartphone between between an an is is app app stored stored and and an an as as external external encrypted encrypted data data values. values. source, source, including including data data 1 1 SHALL 3 3 SHALL SHALL PHI PHI generated generated and and PII PII through through stored stored on on a a device device any any external external associated associated server server with with is is stored stored the the app, app, as as is is encrypted encrypted transmitted transmitted values. values. as as encrypted encrypted values. values. 3 3 Unless Unless PHI PHI and and PII PII has has been been transmitted transmitted to to a a data data set set maintained maintained by by a a Health Health Plan Plan or or 4 4 4 4 SHALL Health Health Provider, Provider, the the account account holder holder can can delete delete information information collected collected through through the the app, app, including including data data generated generated by by a a device device associated associated with with the the app. app. 5 5 5 5 6 6 6 6 7 7 Regulations, Regulations, 7 7 standards, standards, and and implementation implementation tools tools Regulations, Regulations, standards, standards, and and implementation implementation tools tools Implementation Implementation guidance guidance by by use use case case Implementation Implementation guidance guidance by by use use case case Use Use Case Case A: A: Use Use Case Case A: A: Use Use Case Case B: B: Use Use Case Case B: B: Use Use Case Case C: C: Use Use Case Case C: C:
3.4 Security for Data at Rest 1 SHALL PHI and PII stored on a smartphone is stored as encrypted values. 3 SHALL PHI and PII stored on any external server is stored as encrypted values. 4 SHALL Unless PHI and PII has been transmitted to a data set maintained by a Health Plan or Health Provider, the account holder can delete information collected through the app, including data generated by a device associated with the app. 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.4 Security for Data at Rest 1 PHI and PII stored on a smartphone is stored as encrypted values. 3 SHALL PHI and PII stored on any external server is stored as encrypted values. 4 Unless PHI and PII has been transmitted to a data set maintained by a Health Plan or Health Provider, the account holder can delete information collected through the app, including data generated by a device associated with the app. 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.5 Security for Data in Transit 1 SHALL PHI and PII transmitted between an app and an external data source, including data generated through a device associated with the app, is transmitted as encrypted values. 3 4 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C: 3.5 Security for Data in Transit 1 PHI and PII transmitted between an app and an external data source, including data generated through a device associated with the app, is transmitted as encrypted values. 3 4 5 6 7 Regulations, standards, and implementation tools Implementation guidance by use case Use Case A: Use Case B: Use Case C:
HL7_Consumer_Mobile_App_Framework_Minutes_v20150818.docx