Skip to content

Commit

Permalink
Fixing and updating headers
Browse files Browse the repository at this point in the history
  • Loading branch information
dbarnesbrownNR committed Jul 6, 2021
1 parent 9ec7448 commit 37579a0
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 13 deletions.
Expand Up @@ -7,7 +7,7 @@ tags:
- HIPAA
metaDescription: HIPAA enablement at New Relic and requirements for HIPAA-enabled acccounts.
---
## HIPAA readiness overview
## HIPAA readiness overview [#overview]

Before you request New Relic’s Business Associate Agreement ("BAA"), we want to provide some additional context regarding setup for HIPAA-enabled Accounts on New Relic.

Expand All @@ -16,27 +16,27 @@ Before you request New Relic’s Business Associate Agreement ("BAA"), we want t
- Our application performance monitoring and data analytics solutions are intended for use cases with non-sensitive timing and metric data, which you control by your deployment and configuration choices.
- Additional information is available in our BAA FAQs located in our [HIPAA BAA FAQ](https://newrelic.com/termsandconditions/hipaabaafaq).

## Acknowledgements and Requirements
## Acknowledgements and Requirements [#acknowledgements-requirements]

### New Relic's role
### New Relic's role [#new-relics-role]

You acknowledge and agree that New Relic does not provide an electronic medical records, is not a health information exchange or health information organization, and is not an electronic data interchange, and you will not send Designated Record Sets, substantial portions of Designated Record Sets, or any other health records in full to New Relic, such as eligibility and benefit inquiry and response data, claims status inquiry and response data, authorization and referral request data, prior authorization and notification inquiry, hospital admission notification data, medical claims data, electronic remittance advice, pharmacy claims data, health summary documents, continuity of care documents, medical images, discharge data, medical data transcriptions, electronic prescription, medical billing data, wellness and disease management program files, clinical case notes, explanations of benefits, or medical billing statements; or use the Services as a personal health record for patients.

### Setup
### Setup [#setup]

- You must sign New Relic’s BAA before sending any PHI to New Relic.
All capitalized terms used on this page shall have the meanings given to them in the BAA.
- You must appropriately configure your HIPAA-enabled Account and New Relic Services as described in New Relic’s BAA and Documentation.
Your New Relic order must include an eligible New Relic service subscription for HIPAA account enablement on New Relic.
- Your New Relic account representative must confirm your HIPAA-enabled Account is set up and ready before sending any PHI to such HIPAA-enabled Account.

### Limited handling of PHI
### Limited handling of PHI [#limited-handling]

You acknowledge and agree that your use of the HIPAA Covered Services may occasionally involve limited, incidental handling of Protected Health Information and personal data. For example: if a subset of the HIPAA Covered Services temporarily processes IP addresses, a Customer may elect to capture email addresses, and limited data elements may end up in a log. Subject to your compliance with the requirements, you may send:
- Protected Health Information regulated by the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, “HIPAA”) and personal data concerning health to the HIPAA Account, which is defined in the Business Associate Addendum; and
- Data concerning health as set out in European Union Regulation 2016/679 Article 9. To the extent any information sent to New Relic pertains to health about an EU data subject, a Customer must have express consent to send sensitive Personal Data, and if applicable, explicit consent as required in European Union Regulation 2016/679 Article 9.

### Product, service, and feature-specific requirements
### Product, service, and feature-specific requirements [#product-service-feature-reqs]

- You may only use the services listed under “HITRUST CSF” set forth in our [regulatory audits documentation](/docs/security/security-privacy/compliance/regulatory-audits-new-relic-services/)
- You must select the [U.S. data region](/docs/using-new-relic/welcome-new-relic/get-started/our-eu-us-region-data-centers/) for all your HIPAA-enabled Accounts. Accounts in different geographical regions are ineligible for HIPAA-enabled Accounts.
Expand All @@ -45,21 +45,21 @@ You acknowledge and agree that your use of the HIPAA Covered Services may occasi
- You may not create an [Alert Policy](/docs/alerts-applied-intelligence/new-relic-alerts/alert-policies/) with any PHI in any [Alert Conditions](/docs/alerts-applied-intelligence/new-relic-alerts/alert-conditions/create-nrql-alert-conditions/) or Alert Policy which uses email as a notification channel.
- You may not use such existing New Relic Account for your HIPAA-compliance needs if you have enabled Incident Intelligence for an existing New Relic Account. Instead, you must create a new New Relic HIPAA-enabled Account before sending any PHI.

### [Global Technical Support](/docs/licenses/license-information/general-usage-licenses/global-technical-support-offerings/)
### Global Technical Support [#global-tech-support]

- You may not use New Relic’s Zoom subscription with any PHI. Please provide your own HIPAA-compliant video conferencing service. It is solely your responsibility to ensure the video conferencing service you choose meets your compliance obligations.
- You may not use New Relic’s Google Workspace subscription with any PHI. Please do not send any emails with PHI to New Relic or include in any Google Workspace application such Google Docs or Google Slides.
- You may not use New Relic’s Slack subscription with any PHI. Please do not send us Slack messages containing any PHI.
- You must ensure that your users’ access to New Relic GTS support tickets are appropriate and must remove users who should not have access to PHI.
- Support related emails for HIPAA customers will not send ticket subjects or ticket comments via email. Instead, they will contain a link to the ticket and direct people to view and respond to the ticket in our Support ticketing system.
- Support-related emails for HIPAA customers will not send ticket subjects or ticket comments via email. Instead, they will contain a link to the ticket and direct people to view and respond to the ticket in our Support ticketing system.

### Users with U.S. data localization requirements
### Users with U.S. data localization requirements [#data-localization]

- You may not use New Relic Mobile.
- You may only add New Relic team members based in the United States.
- When requesting either [New Relic Support[(https://support.newrelic.com/)] or [New Relic Expert Services](https://newrelic.com/expertservices).

## EU and Health Data
## EU and Health Data [#eu-considerations]

To the extent you are not subject to HIPAA, you have signed a data processing agreement (“DPA”) with New Relic, you want to send data concerning health as described in GDPR, and you otherwise meet the requirements above, then:
- “BAA” referenced above means the amendment to the DPA signed with New Relic.
Expand Down
Expand Up @@ -35,9 +35,9 @@ New Relic's time frames for supported regulatory frameworks and annual audits in
* [SOC2 Type 2 audit:](https://newrelic.com/security) Reviews New Relic's implementation and maintenance of controls for the previous 12 months. The annual audit spans August 1 of the previous year through July 31 of the current year (for example, August 1, 2019 through July 31, 2020).
* [FedRAMP Agency (Moderate):](https://marketplace.fedramp.gov/#!/product/new-relic?sort=productName&productNameSearch=new%20relic) Reviews New Relic's implementation and maintenance of NIST 800-53 rev. 4 controls for the previous 12 months. The annual audit spans November 28 of the previous year through November 28 of the current year (for example, November 28, 2019 through November 28, 2020).

## Services in scope by compliance program [#services]
## Services In Scope by compliance program [#services-in-scope]

The following table describes New Relic's Services in scope by New Relic's compliance programs.
The following table describes New Relic's Services In Scope of New Relic's assurance programs.

* A check <Icon style={{color: 'green'}} name="fe-check"/>
indicates that this service in scope of the most recent assessment and current reports.
Expand Down
Expand Up @@ -9,7 +9,7 @@ Today, we’re releasing our HIPAA-enabled observability platform for healthcare

Covered entities including insurance companies, health maintenance organizations, government assistance programs, providers, and clearinghouses can now send application, infrastructure, digital experience, and network monitoring data to the Telemetry Data Platform while maintaining HIPAA compliance.

![HIPAA-enabled accounts are now available on New Relic.](./images/hipaa1.png "A graphic showing New Relic's relationship to HIPAA customers.")
![HIPAA-enabled accounts are now available on New Relic.](./images/hipaa1.png "An image showing New Relic's relationship to HIPAA customers.")

Our solution supports the following:
1. **Domains:** Infrastructure, applications, digital experience, and network
Expand Down

0 comments on commit 37579a0

Please sign in to comment.