Confirm purpose
Document why the receiving organization needs the records.
HIPAA
File sharing for HIPAA-regulated workflows
Before using a transfer service for electronic protected health information, have your privacy and security leads assess the proposed workflow, safeguards and applicable agreements.
Start my free trial ↗7 days. Up to 5 users.
No credit card required.
No credit card required.
01 / THE PRACTICAL POSITION
Define the health information exchange
Identify the sender, receiving organization and purpose. Confirm which records the recipient needs before exporting anything from the source system.
Privacy Rule
Ask the privacy lead to assess the proposed use or disclosure before release.
Security Rule
Assess the administrative, physical and technical safeguards for the ePHI workflow.
02 / A CLEARER ARCHITECTURE
Assess the service before use
Review the proposed configuration, access checks and evidence with the people responsible for your HIPAA program. Confirm any required business associate agreement before sending ePHI.
01Identity
02Protection
03Access
04Evidence
01Administrative safeguards+
Governance turns security from a product setting into a repeatable operating practice.
02Physical safeguards+
Facilities, workstations and devices still affect who can reach systems and health information.
03Technical safeguards+
System controls help manage access, integrity, authentication and transmission security.
03 / THE WORK IN PRACTICE
Test with synthetic records
Use a fictional patient file to test the invitation, recipient verification and access period. Check how staff would respond to a wrong recipient or an unexpected access event.
Reduce the data
Check that the export contains only the information approved for this exchange.
Verify the recipient
Confirm identity and authority using your organization’s procedure.
Apply safeguards
Apply the approved configuration and test it with fictional records first.
CUSTOMER PERSPECTIVES
All customer stories ↗“
“I would highly recommend MX to anyone looking to send and receive secure data quickly and efficiently.”
Daniel FrancisProject Engineer, Envisage Group
Read the story ↗01 / 02
04 / THE DETAILS MATTER
Give the case owner a usable record
Keep the release authorization and exchange activity together under your organization’s procedures. Refer to the HHS HIPAA Security Rule guidance when assessing safeguards.
EXCHANGE NOTE01 / 04
Privacy Rule
Ask the privacy lead to assess the proposed use or disclosure before release.
EXCHANGE NOTE02 / 04
Security Rule
Assess the administrative, physical and technical safeguards for the ePHI workflow.
EXCHANGE NOTE03 / 04
Breach Notification Rule
Route a suspected incident to the designated privacy or security team for assessment.
EXCHANGE NOTE04 / 04
Business associate obligations
Establish the parties’ roles and confirm any required agreement before using the service for ePHI.
Controls within a wider program. MX can support configured file-exchange safeguards. It does not certify your organization or establish compliance by itself. Confirm the service configuration, contractual terms and suitability for your data before deployment.
GOOD QUESTIONS. CLEAR ANSWERS.
A clearer route.
From the start.
Practical answers about hipaa and where MX fits.
How does MX fit this workflow?+
Give healthcare organizations and partners a controlled route for sensitive health files. Named access, permissions, MFA, protected storage and activity records can help support the safeguards around ePHI.
Does using MX make our organization compliant?+
No. Technical controls are part of a wider program. Your organization remains responsible for the applicable obligations, risk assessment, policies, permissions and contracts. Confirm any required agreements and service configuration with MX before handling regulated information.
What should we confirm before exchanging ePHI?+
Confirm the applicable business associate agreement, permitted uses and service configuration with MX before transferring ePHI. The design preview and free-trial form do not establish an agreement or authorisation to handle regulated health information.
What controls can we apply to a file exchange?+
Named-recipient access, authentication, permissions and expiry settings help define the exchange. Activity records let your team review what happened. The available configuration should be matched to your requirements.
Does MX replace our existing work tools?+
Keep creating, editing and storing files in the systems your team already uses. MX focuses on controlled handoffs, rather than background synchronization, live co-authoring or permanent backup.
What is included in the free trial?+
Try the MX feature set for 7 days with up to 5 users. No credit card is required.
YOUR NEXT EXCHANGE STARTS HERE
Test an exchange with your team
Invite a colleague to receive a sample file, then review the access settings and activity together.
7 days freeUp to 5 usersNo credit card
- Full feature access
- Unlimited file size transfers
- Named recipients and MFA
- Custom branding and upload portals