HIPAA compliance at SurveyMonkey
SurveyMonkey and HIPAA
SurveyMonkey gives anyone in your organisation the ability to create surveys while allowing your organisation to own its data, manage users and simplify billing for multiple accounts. HIPAA-compliant features are available to customers to give them an additional way to safeguard the security of protected health information (PHI) that they collect via online surveys. SurveyMonkey maintains appropriate administrative, physical and technical safeguards to provide for the continuing security of your PHI.
Why HIPAA security is important
Due to concerns around privacy of information, the Health Insurance Portability and Accountability Act (HIPAA) became law in the U.S. in 1996, enacting strict rules around the protection of health information. Because HIPAA violations are taken very seriously by the U.S. government, and often result in hefty fines, HIPAA-compliant surveys can help your organisation function smoothly.
Thanks to SurveyMonkey’s HIPAA-compliant security features, Enterprise customers can feel confident that their surveys will comply with HIPAA requirements.
SurveyMonkey as a business associate
Our standard business associate agreement (BAA) meets the requirement of HIPAA, making it easy for covered entities to bring SurveyMonkey on board as a business associate and to enable HIPAA-compliant features on their SurveyMonkey account.
Customers can preview and sign a BAA in My Account. For more detailed instructions, click here.
HIPAA compliance for every healthcare organisation
Different types of covered entities use surveys for different purposes, including to:
- Improve their performance by collecting patient feedback securely
- Mitigate the risk of a PHI breach when gathering patient registration information
- Conduct CAHPS (Consumer Assessment of Healthcare Providers and Systems) surveys discreetly and confidently
- Simplify medical research with pre-populated questions
- Reduce survey risk on mobile devices with SSL/TLS encryption
- Reliably collect data for healthcare accreditation
- Securely obtain actionable insights about patient and hospital safety culture
In addition to ensuring that we fulfil our duties as a business associate, we’ve designed additional safeguard features for our HIPAA-enabled accounts to help covered entities comply with their own HIPAA obligations. These enable us to:
- Ensure automatic logout after an idle period to prevent inappropriate access to sensitive information
- Utilise activity account logs to understand who is accessing company health information
- Benefit from PHI Share alerts to take action when personal health information is shared
- Enter into a BAA for maximum conformity and accreditation
Conduct online surveys while complying with HIPAA
Now, anyone with an Enterprise plan can enable HIPAA-compliant features on their account at an additional cost. It’s easy to get set up:
- Upgrade to Enterprise.
- Enter into a Business Associate Agreement.
- We’ll turn on additional privacy safeguards that are compliant with HIPAA security requirements.
Questions?
Please visit our HIPAA FAQ, or feel free to contact us with any questions you have about our product features or how we can help you comply with HIPAA’s requirements.
To learn more about HIPAA, please visit the U.S. Department of Health and Human Services’ website: http://www.hhs.gov/ocr/hipaa/.
Discover more resources
Healthcare Leader
Healthcare leaders can use this toolkit to help them better understand the patient and employee experience.
How to use annual health survey data to inform decisions
Learn about some of the latest annual Health Survey for England trends and how they can inform campaigns, marketing strategies and healthcare provision.
GP Patient Survey key insights and takeaways
We explore some of the key takeaways from the 2024 GP Patient Survey, including patient satisfaction, getting an appointment and more.
Patient registration form template
Seamlessly collect patient registrations with our fully customisable, HIPAA-compliant patient registration form template.