Selecting a HIPAA eCommerce WooCommerce Development Team

HIPAA (Health Insurance Portability and Accountability Act) compliance is necessary for businesses in the healthcare sector, who operate through eCommerce. Receiving, storing, transmitting, or handling in any possible way information that is considered protected health information (PHI), must be done under the HIPAA compliance umbrella. Developing an eCommerce platform which follows the complicated guidelines about the security and privacy of PHI (called ePHI when submitted electronically) can be a handful for someone who has no experience in this arena. Hence, choosing the right team to help with it can be a blessing, but choosing the wrong one can be a curse. In this article we will elaborate on what one should look for when selecting a team to make their WooCommerce platform HIPAA compliant.

In order for a healthcare visionary to develop a HIPAA compliant website, and avoid being fined for disobedience of certain HIPAA aspects or a potential data breach, it is in their best interest to make sure their team is HIPAA compliant. By the term “team”, we refer to vendors, developers, and other business associates, that the healthcare-related business trying to set a HIPAA compliant website will have to “vet” before trusting them with activities related to ePHI. Research has shown that up to 45% of ePHI-related breaches in hospitals, was traced back to a business associate, however it was the hospital which took the blame. Choosing developers, vendors, and other associates carefully is the least a business owner can do towards protecting customers’ data, and eventually their business name and well-being. Choosing the right team to ensure a WooCommerce HIPAA compliant website might not be as straightforward as one might think, and it can require some research. There are some steps that can be followed and some tips to help towards making the best choice, as we will see in the next section.

How to Ensure HIPAA Compliant Hosting?

HIPAA compliance certification is, or should be, the goal of every healthcare-related website and eCommerce platform, and certainly of those who choose to build their platform using WordPress and WooCommerce, as they need that much extra effort to achieve HIPAA-compliant hosting. Business associates can make or break the pathway to compliance, and possibly the success of the one’s business. When choosing them, one should be looking for the following aspects:

• Knowledge and understanding of HIPAA. A developer who has never heard of HIPAA before should not be trusted as an associate on a platform which is working towards HIPAA compliance. The offers and the packages might be very tempting and ostensibly profitable, but in a case of data breach all this money saved –and more– will be spent towards cleaning up a mess potentially fatal for the business.
• Previous experience. Is this developer HIPAA compliant? Have they worked with a HIPAA Compliant eCommerce platform before? Are they willing to go the extra mile, past the initial few steps towards compliance? Can they take your platform to the next level of compliance using appropriate tools (app integration, plugins…)? These are questions that you, as a business owner, need to ask your associates and expect nothing less than “yes” for an answer.
• A solid business associate agreement. Associates need to sign an agreement with the business owner, stating their commitment to HIPAA requirements, at least the recognized as necessary ones. Make sure to examine this agreement thoroughly, as the fine prints could potentially make you liable in the case of a data breach.
• A satisfying server level agreement. Even in the case that all previous steps have been followed successfully, a deal could fall apart due to the service level agreement. There needs to be a mutual agreement between you as a business owner and the associate, on technical issues regarding ePHI and HIPAA compliance, such as when and how ePHI will be destroyed after the termination of the contract, how often data backup will occur, or access of your business to ePHI stored by the vendor among others. Another important point of this agreement is to decide which part is responsible for which potential breach.
• The associate’s approach towards breaches or emergencies. Knowing beforehand how your associate will handle an emergency is very important for future collaboration. If they have a strict policy, with clear steps on how to handle a breach notification and mitigate the issue, and a communication strategy for security issues, they are on the right track. Especially if their policy, steps, and strategy are HIPAA compliant and/or you are happy with them.
• Testimonies. Similar to checking reviews before trying a new restaurant, you should check reviews before trusting a new partner. Try to find previous collaborators of your candidate, and ask them about their HIPAA-related experience with this associate. Where there any issues, how were they dealt with, where both parties satisfied by the partnership? These are all questions you want to find the answers to, as by trusting this associate could put you in a similar spot.