HIPAA
Monitor third-party scripts on patient-facing pages for HIPAA compliance with cside, with alerts when a script is flagged as malicious or vulnerable and per-vendor permission controls.
Available on Enterprise and for teams whose feature access includes this capability. If the option is unavailable, contact cside to confirm your team’s access.
Overview
HIPAA requires covered entities to protect electronic PHI (ePHI). Third-party scripts on patient-facing pages can access data entered or displayed on the page, including PHI.
HHS OCR has clarified that tracking technologies transmitting PHI to third parties without authorization may violate HIPAA.
Relevant HIPAA sections
| Section | Requirement | cside Feature |
|---|---|---|
| §164.312(a) | Access controls | Script blocking |
| §164.312(b) | Audit controls | Script activity logs |
| §164.312(c) | Integrity controls | Change detection |
| §164.312(e) | Transmission security | Network request monitoring |
| §164.308(a)(1) | Risk analysis | Script inventory, behavioral analysis |
What cside tracks
- All scripts loaded on your patient-facing pages
- Data access (form inputs, cookies, localStorage)
- Network requests and destinations
- Script payload changes
Protecting patient-facing pages
cside monitors every page of a domain, so there is no separate list of PHI pages to maintain. To cover your patient-facing pages:
- Add the domain that serves them and deploy the cside script or set up the Scan Method
- Create notification configs for Script Threat Detected, High-risk Vulnerability, and Vulnerable Script Detected so your team is alerted when a script on those pages is flagged as malicious or matches a known vulnerability
- Review each vendor’s permissions and block form field access, keystrokes, and network requests for vendors that have no business reading patient data
BAA
Enterprise customers can request a Business Associate Agreement. Contact sales@cside.dev.
Related pages
Thanks for your feedback!