RON: Yeah. It's kind of amazing that every one of them are different. I mean, we've done mobile health apps where clients can schedule appointments with their doctor and request refills on prescriptions. They call them Mhealth apps. You've got doctor/patient portals that we've done quite a few, we've got billing portal where they're paying their bills online, and a huge one that we do a lot of, especially with our background in eCommerce, are companies dealing with an eCommerce pharmacy and HIPAA eCommerce. Because if a patient comes in, and they order a controlled substance, now all of a sudden "Ron ordered Oxy," and that's recorded, there's PHI.
Whether it's a diagnosis or specific drug related to a person, now we've generated a scenario where we're collecting PHI information and we're storing that. So a lot of times a very difficult one is eCommerce, and I'd love to hear your thoughts on that, because the place where I really see that getting complex, and I don't know how deep we want to go into it here, is kind of with GDPR, because they may come back and want to remove their data, but you, as pharmacy eCommerce, have to still maintain that, hey, I sold this government controlled Oxy to Ron back in 2019, and I only gave him a one-month supply or something. That has to stay. So how does GDPR work with a HIPAA-compliant database and with eCommerce?
CHRIS: Yeah, that's a great question. I think that's a great scenario that's maybe comparable to going uphill in the snow on a very narrow road for some vendors. And basically we have to comply with all of these rules. So one of the big things that I would say is that, whenever we're looking at fundamentally eCommerce, it really does boil down to having multiple fail safes and having just kind of this assumption of failure as a mindset to be able to go through and test and validate the security, and not just the security of the software, but also the security of the team and the organization, and the mindset of the team that's using these systems and these tools. Because most commonly nowadays, a lot of hacks and breaches are occurring on the softer side of things with the people themselves, with them being hijacked or their accounts being hijacked.
But anyway, to your question, GDPR mixed with HIPAA eCommerce is kind of like a Venn diagram where you've got to be able to hit the sweet spot. So yeah, I think with GDPR, the big thing is, in many ways it's more complex or more stringent than HIPAA is, and so being able to essentially present to the user that, hey, this information that's used on the system, you have the right to select to not put your information in for that, and we need to be able to show the user what that's going to impact if they don't share certain information. Maybe they won't have the ability to continue online, maybe they'll need to get in touch and have more of a manual process. We also need to be able to let the end-user know that this is the data that we're using, and maybe not necessarily just put all their data out there, but just kind of generally say, these are the areas where your data is being used, and you have the right to remove this data.
But again, we just want to let them know if you remove your data from the system, we're removing your data, so we can't really use it in eCommerce in the traditional sense. But you're right. I mean, the data does need to be, from a compliance perspective, it needs to meet this narrow Venn diagram sweet spot. So typically what we would do in that scenario if someone wanted to get rid of their data, but we'd still need to comply with the prescription tracking information, et cetera, is we are going to be persisting that relative to what the business—the covered entity—needs to meet their legal requirements. And what I can tell you for pretty much every scenario, that it gets pretty complicated. It may make sense to actually work with a HIPAA lawyer and make sure that you're actually getting T's crossed and I's dotted properly.
I do not pretend to be a lawyer. And I can tell you, ultimately that's probably where that goes, depending on what kind of prescription data needs to be persisted versus what kind of data ultimately the lawyer might determine that needs to be removed whenever they request the data removal. The capability is there to get rid of the data, but allow the system to still function. So we can keep information in there about the order and just genericize it and do things like that that kind of sanitize that user's information out of the system, but still allows the EMR or ERP system to function, it just isn't going to be as accurate with that user's data.
RON: Yeah, that makes sense. We've done a lot of different things with that, and it sounds like that might be an upcoming webinar where we start talking about GDPR and the EU and the new California restrictions.
CHRIS: Look at you. Yeah, definitely will be.