HIPAA-enabled CMS
Optimizely offers a HIPAA-enabled variant of CMS (SaaS) for organizations that handle protected health information. Some standard CMS (SaaS) features are excluded in this variant to meet compliance requirements.
If you have a HIPAA-enabled CMS, you can be confident of compliance with HIPAA regulations, which are essential for healthcare organizations and businesses that handle Protected Health Information (PHI). Optimizely CMS includes auditing and security measures to protect patient data and ensure privacy.
This content also applies to the PaaS Portal and Deployment API.
A HIPAA-enabled CMS is not compatible with other non-HIPAA enabled Optimizely products. Data exchange outside the platform is only allowed with other HIPAA-enabled integrations, ensuring that all data handling remains compliant. You must ensure any integrations or additional tools you use are also HIPAA-compliant.
Features and third-party integrations in CMS that are not HIPAA-compliant are modified or restricted to ensure that data exchanges are secure and compliant. The following features are excluded from CMS (PaaS and SaaS) for HIPAA Compliance.
- SendGrid SMTP – Optimizely does not provide the SendGrid Simple Mail Transfer Protocol service because it does not support HIPAA. Customers can use a tool of their choice instead.
- Production database exports – Export databases from the Developer portal.
- Content sync-down – Copy content from Production to lower environments.
- Edge log exports – Export Cloudflare logs about Firewall events, DNS logs and other data.
- Project migration – Start a migration from one project to another.
Differences between standard and HIPAA-enabled CMS offerings
The following table compares the standard and HIPAA-enabled CMS, incorporating the specific capabilities and benefits relevant to healthcare organizations.
Aspect | Standard CMS | HIPAA-enabled CMS |
|---|---|---|
Compliance and security | Standard security measures | Additional auditing and security for HIPAA compliance |
Feature and integration restrictions | Full feature and integration availability | Certain features and integrations restricted for HIPAA compliance |
Data exchange | Flexible data exchange options | Data exchange only with HIPAA-enabled integrations |
Exclusions in PaaS & SaaS | Features like SendGrid SMTP, database exports, and so on, are available | Excludes SendGrid SMTP, database exports, content sync-down, edge log exports, project migration |
Compatibility | Compatible with a wide range of Optimizely products | Not compatible with non-HIPAA enabled Optimizely products |
Capabilities and benefits | General content management capabilities | Delivers personalized experiences based on health needs and history. Tests content, layouts, and campaigns for effectiveness. Provides analytics and insights into performance and behavior. |