Question

I'm in a startup company in the healthcare space looking for an issue tracking system that meets HIPPA compliance. Can anyone tell me if Fogbugz (and the security model around it) would meet these requirements?

Thanks.

Answer 1

A complicated question with no easy answer. This depends on exactly what you mean by HIPPA compliance, or perhaps more accurately, who your auditor is :).

I'm not familiar with HIPPA myself, but FogBugz has not been certified to meet any specific criteria. On the other hand, we do have several customers who have mentioned using it in a HIPPA environment, so at least for them, it was good enough.

If the requirements are something like "people not allowed to see the data can't see the data", you're in luck. FogBugz doesn't allow that.

If the requirements are something like "all activity is logged", it's a tougher question. Case edits are all recorded and saved and there are web server logs for every page view, so maybe that's good enough, but auditing requirements are sometimes very specific.

As a specific example, one customer required buying licenses because they felt the On Demand service didn't fit the requirements. Another customer did go with On Demand after we assured them we wouldn't look at their data.

Rules are always subject to interpretation, so the bottom line is we're at the mercy of the individual doing the interpreting.