Panopto and HIPAA compliance

Panopto does not have a business affiliation agreement that guarantees security and does not meet HIPAA Compliance Regulations (Health Insurance Portability and Accountability of Act). The following guidelines are intended to offer alternatives for faculty to meet HIPAA Compliance Regulations and offer students access to course materials for asynchronous learning. 

It is the responsibility of the instructor to authorize recording as either a video recording or recording limited to audio only.

If a lecture is video recorded (which includes audio)

• Faculty should have patient consent for use of images for educational purposes.
• Patient images that contain protected patient information such as a full facial picture, must be deleted from the video recording after the lecture and prior to storage in the cloud or uploaded for access by students. This requires the faculty member to provide time-stamped segments that will need to be edited to remove the time segment prior to storage in the cloud or uploaded. Faculty should have patient consent for use of images for educational purposes. 

If a lecture is limited to audio recording only

• Faculty should have patient consent for use of images for educational purposes.
• Patient images can be shown in the lecture and no other visual recording devices are permitted. 
• The PowerPoint lectures require editing to remove patient identifiers and modify images to ensure the patient cannot be identified. The modified PowerPoint lecture can be printed as a pdf document. Only the pdf document (HIPAA compliant) should be uploaded. Do not upload the PowerPoint file. In this manner, students can view the “print” images and follow along with the audio recording.
• Any electronic image that is modified to meet HIPAA Compliance Regulations must be converted into a pdf file. This prevents technical  manipulation of an image that could be reversed and expose patient identity.