hipaa united-states
HIPAA user names and emails in logs
<p>We are developing software and interested in the following matter: 
Is having email addresses and usernames of our users in file logs a HIPAA violation or not? </p>

<p>NOTE:<br>
1. We are not going to store passwords in the log files just usernames and email addresses.<br>
2. These file logs are used internally only. </p>

<p>I don't see any issue in accordance to this list <a href="https://www.hipaajournal.com/hipaa-compliance-checklist/" rel="nofollow noreferrer">https://www.hipaajournal.com/hipaa-compliance-checklist/</a> however it would be better to know for sure. </p>

<p>Thank you.</p>

<p>Technically, HIPPA regulates the ways in which health information is disseminated, not the ways in which it is used only by the doctor and his staff as long as it's not transmitted.</p>

<p>Therefore it would not cover the logs if they are only accessible to the doctor and his staff. However, just as a smart way of doing things, you should use encryption, whether the law tells you to or not. Treat people's data the right way, no matter what the law says.
<a href="https://www.hipaajournal.com/hipaa-encryption-requirements/" rel="nofollow noreferrer">https://www.hipaajournal.com/hipaa-encryption-requirements/</a></p>
