HIPAA Compliance

Overview
Experiential Learning Cloud (ELC) does not by default support storage of Protected Health Information (PHI) across the platform. The only ELC feature authorized to store PHI is the Video Assessment Tool and only when a Business Associate Agreement (BAA) is in place.

Policy details
- Master Service Agreement (MSA): The standard MSA signed by universities using ELC does not address HIPAA/PHI requirements or liability. Therefore, under the standard agreement PHI must not be stored in ELC except as described below.
- Allowed PHI storage: PHI may be stored in the Video Assessment Tool only, and only if the university and Lumivero have executed a BAA that explicitly permits PHI use and defines responsibilities and liability.
- Prohibited PHI use elsewhere: All other ELC areas—time tracks, forms, document uploads, notes, messages, case or client identifiers, etc.—must contain de‑identified data. Client names, identifiers, or any other PHI must be removed or replaced with non‑identifying codes before entry.

How to proceed if you need PHI in Video Assessments
1. Contact your Customer Success Manager (CSM) to express interest in storing PHI in the Video Assessment Tool.
2. Lumivero and your institution will review BAA terms. Do not upload PHI until a BAA is fully executed.
3. After the BAA is executed, follow any additional technical or administrative controls Lumivero and your institution require for PHI handling in the Video Assessment Tool.

Recommendations & best practices
- Default to de‑identification: Treat all non‑video fields and uploads as if they will be stored without BAA protection—remove names, dates of birth, patient IDs, or other PHI.
- Use codes: If you must reference individual cases, use internal codes (e.g., Case‑001) and store a separate, secure mapping outside ELC.
- Train users: Ensure faculty, students, and supervisors understand the PHI restrictions and the requirement to de‑identify content.
- Delay PHI uploads until authorized: Do not upload or submit any PHI to the Video Assessment Tool until your CSM confirms the BAA and procedural controls are in place.

Contact
If you are interested in permitting PHI in the Video Assessment Tool, contact Sales to discuss BAAs and next steps.