Sospes stores workplace incident data which can include injury reports and so a common question or concern is The Health Insurance Portability and Accountability Act (HIPAA) compliance within the tool.
In addition to the broad technical safeguards that Sospes deploys to protect your data, there are special rules pertaining to what government safeguards exist.
Who HIPAA applies to
HIPAA's Privacy Rule only binds "covered entities" and their "business associates." The definition is set out at 45 CFR §160.103:
- Healthcare Providers - Healthcare providers include hospitals, clinics, doctors, psychologists, dentists, chiropractors, nursing homes, pharmacies, home health agencies, and other providers of healthcare that transmit Protected Health Information electronically in connection with a regulated activity for which HHS has adopted standards in Part 162 of HIPAA.
- Health Plans - Health plans that provide healthcare coverage as their principal activity are required to comply with HIPAA. Examples of covered entities under HIPAA in this category include health insurance companies, health maintenance organizations, publicly funded healthcare programs (i.e., Medicare), and military and veterans’ health programs.
- Clearinghouses - Health care clearinghouses are organizations that translate nonstandard data into standard formats and vice versa. The primary purpose of a health care clearinghouse is to accelerate claims, eligibility checks, electronic remittance advices, and other HIPAA-regulated transactions when providers and payers have incompatible systems.
- Business Associates - Third-party service providers who access Protected Health Information (PHI) while performing services on behalf of covered entities.
How Sospes fits into this
Sospes is a workplace safety platform. We don't provide medical care, adjudicate health claims, or process health care billing, so we fall outside HIPAA's scope. The same is true of your HR and safety teams, who aren't covered entities simply because they receive an injury report.
It's also worth noting that an incident report itself isn't a medical record in the HIPAA sense. It's a description of what happened, submitted by an employee, supervisor, or safety team member and is not a diagnosis or treatment note generated by a clinician.
OSHA record-keeping is what applies here
The framework that actually governs this information is workplace injury and illness recordkeeping under OSHA (29 CFR Part 1904). OSHA requires covered employers to record work-related injuries and illnesses and to make that information available to specific people inside the organization - safety personnel, HR, the injured employee's supervisor and facility management. That's precisely how Sospes is designed to route this information: to the roles OSHA expects to be involved in logging, investigating and correcting the hazard behind an incident.
Your data is secure either way
Whether or not HIPAA technically applies, we understand that incident and injury data is sensitive, and we don't treat the legal boundary as the only reason to be careful with it. In practice, that means we:
- Restrict access to incident data based on role, consistent with the OSHA recordkeeping standards your organization already follows.
- Protect your data with the same administrative, technical and physical safeguards we'd expect for our own confidential business information.
- Treat your data as your organization's own and use it only to provide the service you've engaged us for.
- Remain available to talk through your specific data flows, recipient lists, or field-level configuration any time you'd like a closer look.
Happy to go further
We're glad to review the specific roles who receive incident reports in your account, or walk through our security practices in more detail. Please reach out to your Sospes contact and we'll set up time.
This letter reflects our understanding of applicable law as of the date provided and is not legal advice. We encourage you to consult your own counsel with questions specific to your organization.