Office of Compliance
University of Wisconsin-Madison

UW-Madison and UW Health Software and Services for Exchanging and Storing Protected Health Information

Before using this list, please read the following: 

  • This is a list of commonly used software and services authorized for use with protected health information (PHI) along with some commonly available software and services prohibited for use with PHI.  
    • All approved items have been evaluated by HIPAA privacy and security compliance staff, so no further review is needed. 
    • This is not intended to be an exhaustive list of every software or service available for use with PHI. 
  • These items must be used in compliance with relevant guidance. 
    • They must be used with computers and devices issued or managed by UW Health or UW-Madison (i.e. not personally owned devices) 
    • Hyperlinks are provided for items that require additional steps before use.  
    • Please direct any questions regarding use of these items or options for approved remote access to the UW Health Security Team (via UW Health’s Service Desk at 265-7777), or to UW-Madison HIPAA Security Coordinators. 
  • You may use software or services not listed here, but the following steps must first be completed. Completing these steps often causes project delays, and it may not be possible to successfully complete the steps in all cases: 
    • Security assessment (vendor participation required) 
    • Execution of appropriate HIPAA agreements between UW and the vendor (typically includes a Business Associate Agreement) 

UW-Madison Software and Services

This is an accordion element with a series of buttons that open and close related content panels.

Approved

  • Cisco Webex Meetings,  & Webex Teams, & Calls 
  • Electronic health record systems for UHS and Athletics 
  • Electronic Lab Notebook 
  • Enterprise Content Management Service (ECMS) Imaging 
  • Globus 
  • Institutional Shared Network Drives 
  • Microsoft Office 365 work-issued email (when used in compliance with UW-Madison policy) 
  • Microsoft Teams (audio and video only) 
  • Phone calls using UW-Madison-provided mobile devices and landlines 
  • Premium Business Services 
  • Qualtrics 
  • REDCap (WISC, Global Health, and FDA Regulated instances only. Before using any other instance, contact your unit’s HIPAA Security Coordinator) 
  • Research databases or registries provided by study sponsors or collaborators

Prohibited

If you become aware that any of the following items have been used with PHI, submit a HIPAA Incident Report as soon as possible.

  • AI tools not approved for use with PHI 
  • Canvas 
  • Google Workspace (e.g. Drive, Docs, Sheets, Slides, Calendar) 
  • Microsoft Office 365 Calendar Entries 
  • Paging
  • Personally acquired software or services  
  • SharePoint (UW-Madison instance) 
  • Social Media (Unless specifically approved as part of an IRB protocol or University-endorsed publicity campaign)  
  • Texting (Unless specifically approved as part of an IRB protocol) 
  • Other Apps, Software, Tools from Cloud Service Providers not reviewed and approved by UW Health or UW-Madison 

UW Health Software and Services

This is an accordion element with a series of buttons that open and close related content panels.

Approved

  • Health Link 
  • Health Link InBasket Messaging 
  • Epic Haiku (iOS or Android) and Epic Canto (for iPads) 
  • Epic Secure Chat 
  • MyChart (Ambulatory) 
  • MyChart Bedside (Inpatient) 
  • Cisco Webex (Meetings and Chat) 
  • SharePoint 
  • uwhealth.org or uConnect Website Forms 
  • For delivery of UW Health Clinical Telehealth Services to Patients, MyChart Video Visits, Vidyo, AmWell, and WebEx (limited cases)* 
  • For other calls, VoIP Phone Services used with devices provided or managed by UW Health or UW-Madison 

*Staff who provide telehealth services at UW Health or any other healthcare facility must follow the policies and guidance for provision of telehealth to patients at each facility.  

Approved - Use With Caution

  • UW Health’s internal web paging system
  • Well SMS/Text Messaging platform which uses automated protocols for one-directional communication
    • Patients or family members must opt in
    • Patients or family members must not be able to respond
    • Must be approved by UW Health Privacy Officer on a case-by-case basis
  • Institutional Shared Network Drives
    • Should not be used to store duplicative or “shadow” copies of Health Link or Enterprise Data Warehouse data
    • Store sensitive and restricted data types in a “SpecialShares” folder with limited permissions.
  • Microsoft Office 365 work issued email (generally ending in uwhealth.org)
  • RightFax enables inbound and outbound faxing using the RightFax application. Some outbound workflows are integrated with other applications, like Health Link, to facilitate electronic signatures on documents.
    • To learn more or convert a physical fax machine to a RightFax queue, contact the UW Health Help Desk at 265-7777 
    • Verify fax number 
    • Use Cover Sheet 
    • Only use institutionally-provided vendors and institutionally-provided fax equipment 
    • Do not use other electronic fax services like Doximity, eFax or other services 

Prohibited

If you become aware any of the following items have been used with PHI, submit a HIPAA incident report as soon as possible to UW Health.

  • Personally acquired software or tools (e.g.: email accounts, file-sharing accounts, and instant messaging accounts) 
  • Microsoft Office 365 – Calendar Entries with PHI 
  • Canvas (UW-Madison’s Web-based Course Delivery Platform) 
  • G-Suite/Workspace (Google) Tools (Gmail, Drive, Docs, Sheets, Slides, Forms, Calendar, Google+, Hangouts) 
  • Social Media (Facebook, Twitter, Instagram, Snapchat) 
    • **In some situations, an IRB may approve a research protocol involving the use of social media; if so, social media may only be used as stated in the approved protocol 
  • Other Organizations’ Text or Web Paging Systems (Text pages should not include patient/subject identifiers) 
  • Texting 
    • **In some situations, an IRB may approve a research protocol involving the use of texting; if so, texting may only occur as stated in the approved protocol 
  • Virtual Assistants (Alexa, Echo Dot, Siri, Bixby, Alice) 
  • VoIP Phone Services not provided by UW Health or UW-Madison (Google Voice, WhatsApp) 
  • Other Apps, Software, Tools from Cloud Service Providers (e.g.: Slack, and ZendTo) not reviewed and approved by UW Health or UW-Madison

Report a HIPAA Incident