ManageEngine ServiceDesk Plus On-Premise provides various ways for healthcare organizations to comply with HIPAA guidelines and secure and restrict the export of individuals' health information (ePHI).
The application admins can ensure HIPAA compliance by performing the following steps:
Marking fields that contain PII or ePHI: To collect and process ePHI from users, we recommend you do so using additional fields and marking them as fields containing PII or ePHI. This enables you to anonymize or delete these fields when the user is removed from ServiceDesk Plus.
Encrypting PHI or ePHI fields: ePHI fields can be encrypted for additional security. By default, the encryption option will be selected while marking the ePHI field. You can uncheck the encryption option if required. Though field encryption is not mandatory in ServiceDesk Plus, we strongly recommend you to enable encryption for protection of stored data.
Roles and Permissions of technicians whose API key is used for API operations.
Authtoken through which the API call is authenticated.
Anonymization or Erasure of Confidential Data: Fields that are marked as PHI/ePHI can be anonymized or erased when the corresponding user has left the organization.
Secure Export of Sensitive Data: Export of sensitive data can be secured by configuring a file protection password. By enabling this, a unique password will be created for files generated by each user with login permission and a common password can be configured for users without login permission. Based on discretion, the common password can be shared with users who do not have login access to ServiceDesk Plus to access password-protected files.
As an on-premises software application, ServiceDesk Plus does not share or transfer your data out of your local servers. Only information about licensing, payments, and support services is shared with ManageEngine, and this data is not shared with anyone else. Our employees do not have access to personal data collected and processed through ServiceDesk Plus.
You can configure HIPAA-related additional fields for supported modules by marking them as fields containing PII or ePHI and also enabling encryption for those fields. To do this, follow these steps:
Go to Admin > Customization > Additional Field.
Select your preferred module: Incident, Service, User, or Technician.
Click New Field.
Choose your preferred field type: Single Line, Pick List, Multi Line, Numeric, or Date/Time.
Select the option below:
Encrypt the Field: Select this option to encrypt the field. This option is not supported for Numeric or Date/Time type fields. However, you can create a single line field with the Allow numbers only option, and select Encrypt the Field option. For example, if your organization wants to store social security number (SSN), you can create a single line field and configure the following options:
Configure other necessary field properties.
Finally, click Save.
You can configure ServiceDesk Plus to anonymize or delete fields containing sensitive user information when the user is deleted from the application, typically when the user has left the organization. To configure anonymization, follow the steps below:
For all fields in single-instance setups or instance-specific fields in multi-instance setups :
Go to Admin > Users & Permission > Privacy Settings.
Select Show option to anonymize user data while deletion.
Now, select the fields to which anonymization should be applied and click Save.
For application-wide user fields in multi-instance setups:
Go to Admin > Users & Permission > Privacy Settings.
Select Show option to anonymize user data while deletion.
Click Save.
When the Show option to anonymize user data while deletion option is enabled and a user is removed from ServiceDesk Plus, an option to delete the sensitive fields or anonymize them will be shown.
The anonymization option is supported for both default fields that contain sensitive information and for additional fields that are marked as containing PII or ePHI. If additional fields are marked as fields containing PII or ePHI, then these fields will be listed under Admin > Users & Permission > Privacy Settings.
To protect sensitive data in files generated by ServiceDesk Plus from unauthorized access, ServiceDesk Plus allows you to configure file protection passwords. To do this, follow the steps below:
Go to Admin > Users & Permission > Privacy Settings.
Select Enable File Protection Password.
Common Password: Provide a common password that can be shared with users who do not have login permission to access files generated by ServiceDesk Plus.
Finally, click Save.
After the Enable File Protection Password option is enabled, a unique password is generated for each user with login access to ServiceDesk Plus when they export a file from ServiceDesk Plus for the first time. The password can be accessed by the users by clicking their user profile icon and selecting Change Password. The users can configure their own passwords.
ServiceDesk Plus supports generating audit logs for fields marked as PII/ePHI with View, Edit, Add, or Delete permissions. Organizations can enable Enable scheduled data deletion to configure the retention period up to a maximum of 10 years. To learn more, click here. For assistance in generating reports, contact support.
You can disable HIPAA compliance by specifically disabling the respective security configurations as discussed below:
Disable Additional Field Security Configuration
Go to Admin > Customization > Additional Field.
Select your preferred module: Incident or Service.
Click Edit.
Disable Holds personally identifiable information (PII).
Finally, click Update.
To disable the anonymization of fields containing sensitive information, follow the steps below:
Go to Admin > Users & Permission > Privacy Settings.
Unselect the fields for which anonymization must be disabled.
Finally, click Save.
For application-wide user fields in multi-instance setups:
Go to Admin > Users & Permission > Privacy Settings.
Unselect the fields for which anonymization must be disabled.
Finally, click Save.
To disable the file protection password,
Go to Admin > Users & Permission > Privacy Settings.
Disable Enable File Protection Password.
Click Save.
Other security-related features that ServiceDesk Plus offers