The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a United States law that regulates the collection and handling of “protected health information” (PHI). Certain organizations called “covered entities” and their business associates are required to comply with HIPAA.
For SurveyMonkey, being "HIPAA-compliant" means that we offer a service that enables covered entities to collect and manage PHI through surveys in a manner compliant with HIPAA. As part of offering this service, SurveyMonkey ensures that it operates in a way that is consistent and compatible with those laws and SurveyMonkey's role as a business associate to a covered entity user.
SurveyMonkey offers a standard form BAA which meets the requirements of HIPAA. If you're interested in enabling HIPAA features on your account, please contact us.
Once an account is HIPAA-enabled, it cannot be reverted to a non-HIPAA account. If the BAA is terminated, your account will also be closed. See the Downgrades section below for more information.
Once you enable HIPAA-compliant features on your account or team, follow these best practices when performing certain actions to help ensure that you're handling your data responsibly and securely.
HIPAA Security Tips
|Exporting survey results||If you download survey results to your own computer, please ensure that those downloaded files are handled appropriately since they contain PHI. We suggest that you secure those files by encrypting them and only transferring them under an encrypted connection.|
|Sharing surveys with others||When you share a survey, the people you choose to share it with will have access to view and possibly edit the survey, or access any collected survey responses. Remember to only share surveys in a manner consistent with your HIPAA obligations. Only share a survey with people who are authorized to work on that survey.|
|Transferring a survey to another account||If you must transfer a survey to a different SurveyMonkey account, ensure that you are absolutely certain that the receiving account is the one you intend to send it to. To transfer a survey, you must enter the exact username of that account. The transfer process cannot be undone without action by the receiving account holder.|
If your survey contains PHI, it is your responsibility to ensure that such PHI is only disclosed to an appropriate recipient. This means that if you transfer PHI to another account, it is crucial that that account must also be HIPAA-enabled.
|Collecting responses||If you collect PHI in your survey, we recommend that you use a Web Link Collector.|
We do not recommend the use of an Email Invitation Collector. Email Invitation Collectors email survey invitations to contacts with a unique survey link tied to a contact's email address. If respondents are able to edit their responses, a contact of an email invitation could complete all or part of a survey and forward their unique survey link to someone else. This would allow the second contact to view the first contact’s responses, which may contain PHI.
|Sharing survey results||Your survey results may contain PHI, so remember to only share survey results in a manner consistent with your HIPAA obligations. Only disclose results to authorized recipients.|