HIPAA Compliant Ticketing System

contego · 2021-08-26T10:32:46.000Z

Unfortunately with Spiceworks going to the cloud we need a new, HIPAA compliant, ticketing system.

Any suggestions would be appreciated. We have about 150 to 200 employees and on average handle about 100 tickets a month.

As some of you have pointed out, strict HIPAA compliance is unlikely at best. Ideally what we need should at least have a self-hosted option.

sniffersir · 2021-08-26T10:47:08.000Z

Why? The on-premises version will still work. They’re just ceasing development of future updates/support with it.

martin9700 · 2021-08-26T10:49:09.000Z

Why do you need a HIPAA compliant ticketing system? HIPAA is to protect patient data so if you keep patient data out of it you’re fine.

martin9700 · 2021-08-26T10:51:24.000Z

Martin9700:

Why do you need a HIPAA compliant ticketing system? HIPAA is to protect patient data so if you keep patient data out of it you’re fine.

I should also point out that just because something is in the cloud doesn’t mean it’s not HIPAA compliant. I work for a Healthcare SaaS that provides full patient medical records in the cloud.

To be fair, I would be surprised if SW ever got a HIPAA certification so if you just have to have it you’ll need to look elsewhere.

contego · 2021-08-26T10:53:43.000Z

1: I’m sure we’ll be fine for the foreseeable future with what we have now. My manager wants options I guess as a just-in-case kind of thing.

2: We like to ask for our employees to include chart numbers and patient info in the ticket for expediency.

Thank you for your replies. I should have outlined the my request better.

scheff1 · 2021-08-26T11:42:57.000Z

SnifferSir:

They’re just ceasing development of future updates/support with it.

No. The next steps have already followed. Some have already been mentioned in the last section of the product roadmap . Some services have been terminated by Microsoft, some services have been terminated by 3rd party providers. So these integrations became useless as the concerned providers no longer deliver their service.

And the next drops of service by Microsoft and 3rd party providers have already been announced, some to expect later this year, some to expect next year. That’s why Spiceworks has announced EOL a few months ago by end of this year. This will lead to drop of next integrated services. That’s why they recommended in the topic to do some evaluation while ensuring the installation has no Internet access with some hints with what areas to start evaluating. And the download option of the tool has been removed by end of past June as announced ahead of time in the EOL announcement.

SnifferSir:

Why? The on-premises version will still work.

So as you have followed Spiceworks advice to do such evaluation while ensuring no Internet access to come to this conclusion of your statement, may you please publish your evaluation report or provide a link to where you may already have published it in order to follow your argumentation and conclusions and which preparations were necessary to succeed with which reduced feature set?

qwelm · 2021-08-26T11:53:30.000Z

We use Jitbit which, while hosted in the UK, is willing to sign a BAA for their cloud platform.

That said, we’re using their self-hosted product.

danielgreer · 2021-08-26T11:59:39.000Z

We had used Track-IT by BMC for our Help Desk software before moving to SpiceWorks (strictly a cost savings) Track-IT has an onsite version, which is what we used, it’s not cheap by any means, nor is it implicitly HIPPA compliant, but it is onsite, uses a sql database, which means you can encrypt everything to your needs.

IT Help Desk Software | Asset Management | Track-It!

IT Help Desk Software

IT Help Desk Software with Endpoint Management Manage emails from users, tickets, change requests, purchase requests and IT assets all in one place.

contego · 2021-08-26T12:01:03.000Z

Thanks you for your suggestion Qwelm. I just found Jitbit and it does look promising. Its at least one of the more popular options. And the price and features align with what we need.

@qwelm

teresawalker · 2021-08-26T13:31:18.000Z

We are a 25 bed critical access hospital and we use Connectwise. Just started using it a few months ago and love it. We still have our SW ticketing system we ask employees not to put patient info within it.

scottpetsuch · 2021-08-26T16:23:16.000Z

When working for a enterprise healthcare insurance company we used HP Service Manager, Cherwell, and Service Now as ticketing systems. I hope that can help out. This is the documentation on Cherwell security, Cherwell: Enterprise IT Service Management | Ivanti .

swheeler · 2021-08-26T18:00:08.000Z

That’s not how HIPAA works at all. It is a very complicated subject in the details, but I can assure you if you self-host or keep patient info off the cloud version you are fine.

michaelwilliams9840 · 2021-08-27T11:49:37.000Z

As long as you keep patient info out of the tickets which shouldn’t be needed the ticket and you shouldn’t have access to anyways, you should be fine.

I worked in IT for a national healthcare company not long ago. We used the online version of Spiceworks for a bit and worked fine for us. We bounced around to different ticketing systems its hard to recall any particular one. The latest one we had we were able to do a lot of automation. Say a new hire ticket came in it would auto create the accounts based on what the manager selected in the various online portals.

kencarter · 2021-08-27T12:08:03.000Z

We currently have two instances of SW running, one for IT help desk (no HIPAA issue) and a nurses’ oncall ticketing system (very much HIPAA issue).

We’re wiling to not rush finding a replacement for as long as SW continues to function but like everyone else, we’re most concerned about what Microsoft and Google Workspace are going to do that could break SW.

We are currently looking at ManageEngine’s ServiceDesk, their on-prem version. It’s pricey but it does what we want. We would love to find other options, too.

timlucas · 2021-08-27T12:08:06.000Z

As Contego mentioned

2: We like to ask for our employees to include chart numbers and patient info in the ticket for expediency.

We also use our help desk as the EHR help desk which includes removing duplicate accounts or fixing small patient related issues that is a much smoother and expedited process with the pertinent information in the ticket. Trying to track down a nurse that is running between patient rooms to re-find the information they were looking at 5-10-30 minutes ago when they put in the ticket is not a fun task for anyone.

anthonytechguy · 2021-08-27T13:41:26.000Z

SnifferSir:

Why? The on-premises version will still work. They’re just ceasing development of future updates/support with it.

I think you may be incorrect. Microsoft is completely changing the way third party integration works with their email. So if you are using Office365 as your email host, it will no longer work with with Spiceworks. Spiceworks has made a choice to not upgrade their Self-Hosted Help Desk to support Microsoft’s modern authentication methods. That means no emails.

anthonytechguy · 2021-08-27T13:47:49.000Z

Martin9700:

Why do you need a HIPAA compliant ticketing system? HIPAA is to protect patient data so if you keep patient data out of it you’re fine.

Martin,

For me, I use HIPAA as a catch all phrase for Protected Health Information, (PHI), or Personally Identifiable Information (PII). Even a birthday, with a name, can be considered PHI or PII.

Help Desk systems can contain a lot of automation. All it takes is one employee to accidentally forward a HIPAA sensitive email, to the Help Desk email address, to create a HIPAA violation. That is why Self-Hosted, or HIPAA compliant cloud help desk systems are absolutely crucial. This is the #1 reason why many cannot migrate to Spiceworks Cloud.

Ethan6123 · 2021-08-27T14:07:30.000Z

Martin9700:

Why do you need a HIPAA compliant ticketing system? HIPAA is to protect patient data so if you keep patient data out of it you’re fine.

It’s actually pretty common for staff to submit tickets with patient names. I don’t think we could stop them from doing it if we tried.

Any on premises ticket system will work fine for this. If it’s in the cloud you’ll need a signed BAA.

kencarter · 2021-08-27T18:28:31.000Z

AnthonyTechGuy:

SnifferSir:

Why? The on-premises version will still work. They’re just ceasing development of future updates/support with it.

I think you may be incorrect. Microsoft is completely changing the way third party integration works with their email. So if you are using Office365 as your email host, it will no longer work with with Spiceworks. Spiceworks has made a choice to not upgrade their Self-Hosted Help Desk to support Microsoft’s modern authentication methods. That means no emails.

Same with anyone who uses Google Workspace.

spiceuser-miblv · 2021-09-21T20:25:35.000Z

+1 for jitbit as well. Has been working for us fine.