We have taken the necessary steps to ensure that our policies and procedures for data handling meet HIPAA standards. If you need a HIPAA compliant service, first, contact us for the account setup. Once we set up the account, you need to configure your Comm100 account as below:
Account Security Hardening Configuration
- Password Policy
- Password must contain at least 8 characters.
- Password cannot be the same as one of the 4 previous passwords.
- Password expires in 90 days after creation and must be changed before login.
- Check the option: Password must contain three of the four types of characters: uppercase, lowercase, numeric, and special (such as $, &, #, @, and so on).
- Check the option: Password cannot contain the agent’s username.
- Password cannot be changed more than once within 24 hours. (optional)
- Check the option: Password cannot be commonly used password phrases, such as 123456, password, and qwerty.
- The account will be locked after 6 failed login attempts.
- IP Allowlist
Only agents from authorized IP or IP range can access Control Panel and Agent Console. Enable this from Global Settings > Security > IP Allowlist. - Two-Factor Authentication (2FA)
On successfully setting up the 2FA, agents need to input the six-digit passcode generated by the 2FA authenticator app to log into Comm100 account. The setup is performed by each agent individually, which can be located from lower left corner avatar -> profile name -> Security Settings.
What you need to set up:
- Auto Logout
If agents don’t have any mouse or keyboard input for a period of time, the system will automatically sign them out of the Agent Console. This is to prevent unwanted access when the App is left open on a device. Set this for each of your agents on the Agent Console. You can enable this option by clicking agents' avatar on the top right of the Agent Console > Preferences > Global. - Switch Off Send Transcript Access to Visitors
After switching off the Send Transcription option on the visitor side, visitors will lose access to a request for a chat transcript to be sent to their email address(es). - Disable Automatically email chat transcripts for archiving or follow-up.
- Disable the permission of sending chat transcripts to the specified email address(es) for all non-admins (By default, admins have this permission).
- If you are using Webhook, all webhook target URL needs to start with https instead of HTTP.
Features that may not be HIPAA compliant
There are some features that your team can use, but they are not HIPAA compliant. To ensure your account abides by the HIPAA standards, advise your team against using them or use only after proper configuration.
- Agent Chat - Agent Chat enables agents to have 1-1 chat with each other. Although the chat communication is among your team, not your clients, we cannot avoid agents sharing any PHI information in it.
- Social and SMS - Social and SMS allow your visitors to reach you via channels of Facebook, Twitter, WeChat, WhatsApp, LINE, Telegram, Instagram, Signal, and SMS. This feature requires you to integrate your Social or SMS accounts with the Comm100 system. Comm100 implemented security & privacy controls to ensure all the systems meet HIPAA compliance requirements. But the fact is that, for an SMS to be HIPAA compliant, both the sender and the recipient should be authorized users of a secure messaging system that enables them to access and transmit ePHI as required. However, currently, almost all SMS messaging platforms aren’t HIPAA Compliant. Most SMS messages are not encrypted, can’t be recalled when delivered to the incorrect recipient, and may be intercepted when using public or open Wi-Fi networks. The same reasons apply to Facebook, Twitter, WhatsApp, LINE, Telegram, Instagram, Signal, and WeChat.
- Screen Sharing - Screen Sharing allows you to view your visitor's web browser, application, or entire screen in real-time. Before the visitor agrees to share their screen, the system will notify them to select the appropriate screen where no confidential or sensitive information is displayed.
- Ticket - The ticket system provides you with a convenient way of client communication. This service requires you to integrate email accounts with the Comm100 system. Communications between you and your clients are done by emails that may contain ePHI. It may cross the Internet multiple times for each email, and it’s stored on at least four different machines (sender’s workstation, sender’s email server, recipient’s email server, and recipient’s workstation), which makes it quite difficult to secure it properly.
Generally, free and internet-based webmail services (Gmail, Hotmail, AOL) are not secure for the transmission of ePHI, so you should not use these services. You should use business email platforms like G Suite and Office 365. If you are determined to use an internet-based email service, ensure to sign a BAA with them. For your recipients, only if they confirm that they want the unencrypted email (after you inform them their email client may not be secure) you can send it via a secure email service. - Audio & Video Chat - The Audio & Video Chat feature in Comm100 Live Chat enables your agents and your customers to talk over chat at any time.
- Voice Bot - Voice bots are chatbots operating in voice channels. They can understand speech and talk with people like a human agent. Like chatbots, voice bots can run automated chat flows for various purposes, put data into your Customer Relationship Management (CRM) and transfer calls to the appropriate agents.