Enabling HIPAA Compliant in Confluence and Jira Service Management

Question

My company is trying to understand whether the HIPAA requirement configuration is for transmission of data via email and push notifications? Atlassian noted that email and push notifications might be redacted to exclude any potential PHI when products like confluence and JSM are tagged.

With what and how would Atlassian detect PHI to redact them via emails and push notification?
Is there a way to see how this redaction would look like?

Lindsay Bolan · Answer

Below is a screenshot of the default "Public comment edited" notification template looks like when the "safe customer notifications" setting is on. In short, entire variables are redacted (replaced with those black dots in brackets,) so there is no smart detection to selectively remove sensitive/restricted information. The affected variables are work item summary, work item description, and work item comment text. The variables are show with a lock icon in the "Insert variable" menu.

This was a change for my group when we moved to a HIPAA-compliant cloud site, so a lot of our service project administrators have adopted some variation on the template below:

gemory · Answer

This is not a feature that redacts PHI. It simply changes the notification templates to only display bare bones information “This person made a change to this work item”. Then the recipient has to click the link and authenticate in Jira to access additional information. It’s honestly a fairly huge issue for a small subset of people in our company, as we receive tons of JIRA notifications (that we want!) but having to click links to view the tickets each time has drastically reduced workflow efficiency in some cases. I wish Atlassian would allow orgs to apply HIPAA compliance at the Project level!!

Dave Rosenlund (Trundl) · Answer

You're welcome, @Godknows Agbodo 🙏

If you found this answer helpful and think it might be useful to others with a similar question, please consider using "Accept answer."

-dave