PHI High-Risk Data Approved Technologies (Public)

Important things to remember about Protected Health Information:

• Limited Data Sets are considered PHI and are subject to data protections under HIPAA.

• Personal devices may not be used by any research team member to conduct University activities that use PHI. The Sensitive Data Protection Standard strictly prohibits the use of personal devices to access or transmit Sensitive Data.

• Voicemail and University email should never be used to transmit or collect patient/participant informed consent.

• Voicemails should never be forwarded to email to prevent accidental transmission of PHI.

• A Secure Fax means the receiving fax machine is in a secure location only accessible by authorized individuals, a cover sheet accompanies the transmission clearly indicating the recipient, and the recipient has been alerted to the transmission and is able to receive it.

• Chat software, email, and texts cannot be used to communicate with participants during a research project conducted by University Health Care Components where clinical health/medical records and other health information are used for the research unless prior approval has been granted.

• Faxing or scanning documents that include PHI to email is not permitted.

• Physical PHI must always be stored and transported securely.

• Pursuant to the University Electronic Mail Policy, personal email must never be used to conduct University activities.

• The definitions of Data Collection, Data Sharing, Data Transmission, and Data Storage can be found on the Approved Technologies for Research main article.

^Product is approved to be used for transcription services.

#Product is only approved for collection of data from and sharing data with WVU students or faculty for academic purposes.

*Product is approved to collect data and pay human subject research participants. Additional approvals are required from WVU Procurement to use products for participant payment.

%Product is approved for data analytics use.