Is Evernote HIPAA Compliant?
Evernote is not HIPAA compliant and cannot be used to save, store, sync, or share documents and images containing Protected Health Information due to the platform lacking the controls to comply with the HIPAA Privacy and Security Rules. Due to the lack of controls, Evernote will not enter into a Business Associate Agreement with customers.
Evernote serves as an easily accessible repository for a wide range of information, including documents, audio files, images, and video files. One of the key features of Evernote which makes it so useful is the ability to automatically synch files and notes across multiple devices.
Evernote is available as a free app or a paid service for businesses and does incorporate access controls and security features such as single sign-on (SSO) and two-factor authentication to prevent unauthorized use of the applications. Evernote stores data on the Google Cloud platform, which can be HIPAA compliant. Encryption is also supported by Evernote for Mac and Evernote for Windows Desktop. In-note encryption uses an AES 128-bit key.
Evernote is designed to make data sharing as easy as possible, which should raise a red flag if you are thinking about using Evernote with protected health information or files containing protected health information – patients documents or dictated notes for instance.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Is Evernote HIPAA Compliant?
So, with the above security controls, is Evernote HIPAA compliant? While the security controls mentioned above do offer some protection against unauthorized access, they are not currently sufficient to meet the requirements of the HIPAA Security Rule. Further, Evernote does not sign business associate agreements with HIPAA covered entities.
Therefore, Evernote is not a HIPAA compliant note taking app and it should therefore not be used in connection with any protected health information.
There are alternatives that can be used in its place. You can read more about these on the links below:
