Apple Notes is not HIPAA compliant for storing or syncing protected health information through iCloud because Apple does not offer a business associate agreement covering Apple Notes with iCloud. Apple’s iCloud terms and conditions prohibit covered entities and business associates from using the service to “create, receive, maintain or transmit” protected health information.
Why Apple iCloud Terms Bar Protected Health Information
HIPAA sets national standards for protecting the privacy and security of certain health information, known as PHI. Under HHS guidance, any cloud provider storing PHI on a healthcare organization’s behalf requires a BAA even when the information is encrypted and the provider cannot read it.
Apple does not offer a business associate agreement for Apple Notes or iCloud storage. The company’s terms and conditions prohibit covered entities and business associates from utilizing the service to create, receive, maintain, or transmit protected health information. Consequently, deploying the application for this purpose is not HIPAA compliant.
The Hidden Risk of Local Device Storage and Backups
Any proposed local-only use requires a separate assessment of device safeguards and backup settings, particularly because “On My iPhone” notes can be included in iCloud backups.
Evaluating local-only deployment requires a review of device safeguards and backup settings.
Frequently Asked Questions About Health Data Regulations
What is a business associate agreement?
A BAA is a legally binding contract establishing a relationship between a covered entity under HIPAA and its business associates. The purpose of this agreement is to ensure the proper protection of PHI as required by HIPAA regulations.
Who must comply with federal healthcare privacy standards?
HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.
What does federal guidance require for cloud storage providers?
HHS guidance confirms that a cloud provider storing PHI on a healthcare organization’s behalf requires a BAA even when the information is encrypted and the provider cannot read it.
