You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/privacy/hipaa-eligible-segment.md
+44-15Lines changed: 44 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,44 +20,73 @@ Ensure your Workspace is eligible for HIPAA before you configure and send any pe
20
20
21
21
With the BAA signed and Workspace confirmed as eligible, you can start building. For more information about starting a HIPAA compliant implementation, see Twilio's [Architecting for HIPAA on Twilio](https://twil.io/architecting-for-hipaa){:target="_blank"}, which outlines the shared responsibilities and requirements for building and maintaining HIPAA-compliant workflows in Segment.
22
22
23
-
## Data hashing
23
+
## HIPAA Auditing
24
+
Segment maintains audit logs of every read and update action a user performs in the Segment app that may involve PHI/PII.
24
25
25
-
When workspace owners add new destinations to a HIPAA eligible Segment workspace, they can hash any fields [marked as yellow in the Privacy Portal](/docs/privacy/portal) before data is sent to the destination.
26
+
Data captured in the HIPAA audit logs includes:
27
+
-`workspace_id`: unique identifier of the workspace
28
+
-`actor_user_id`: unique identifier Segment assigns to the logged in user
29
+
-`event_type`: The action performed by the user. For example, `Source Debugger Raw Viewed`, `Destination Filter Modified`, or other events
30
+
-`end_user_id`: Segment sometimes assigns this unique identifier to an end-user, event, audience, or journey, depending on the event type
31
+
-`timestamp`: Time in UTC when the action occurred
26
32
27
-
<!---This feature addresses the Special Considerations for HIPAA section on page 28 of Twilio's [Architecting for HIPAA on Twilio](https://twil.io/architecting-for-hipaa){:target="_blank"} guide.--->
33
+
These logs can be provided upon request. For specific requests, please reach out to [[email protected]](mailto:[email protected]){:target="_blank"}.
28
34
35
+
## Data encryption
29
36
30
-
### Configure data hashing for a new destination
37
+
When workspace owners add new destinations to a HIPAA eligible Segment workspace, they can encrypt any fields [marked as yellow in the Privacy Portal](/docs/privacy/portal) before data is sent to the destination.
31
38
32
-
To configure data hashing while setting up a new destination:
39
+
### Configure data encryption for a new destination
40
+
41
+
To configure data encryption while setting up a new destination:
33
42
1. From the Destinations page in the Segment App, click **Add destination**.
34
43
2. Select a destination from the catalog and click **Configure**.
35
44
3. On the Select data source page, select the source you want to connect to your destination.
36
45
4. Click **Next**.
37
-
5. On the Setup page, give your destination a name, fill in any optional settings, and select the **Have Segment hash sensitive data** checkbox.
38
-
6. From the **Fields** dropdown, select one or more fields from which you'd like to hash data and click the **Generate hashing keys** button.
46
+
5. On the Setup page, give your destination a name, fill in any optional settings, and select the **Have Segment encrypt sensitive data** checkbox.
47
+
6. From the **Fields** dropdown, select one or more fields from which you'd like to encrypt data and click the **Generate Encryption Keys** button.
39
48
7. Copy the Private Key to a secure location - **once you finish setting up the destination, this key cannot be retrieved**.
40
49
8. Click **Save**.
41
50
42
51
43
52
> error "Private Key is not recoverable"
44
-
> Segment does not save the private key created during the data hashing setup flow, and cannot retrieve the key after you finish setting up your destination. You can generate a new key without un-encrypting and re-encrypting your data using the instructions in the [Configure new key pairs](#configure-new-key-pairs) section.
53
+
> Segment does not save the private key created during the data encryption setup flow, and cannot retrieve the key after you finish setting up your destination. You can generate a new key without decrypting your data using the instructions in the [Configure new key pairs](#configure-new-key-pairs) section.
45
54
46
-
### Configure data hashing for an existing destination
55
+
### Configure data encryption for an existing destination
47
56
48
-
To configure data hashing for an existing destination:
57
+
To configure data encryption for an existing destination:
49
58
1. Open the [My destinations page](https://app.segment.com/goto-my-workspace/destinations){:target="_blank”} in the Segment app.
50
59
2. Select a destination, and click **Settings**.
51
-
3. On the Settings page, select the **Have Segment hash sensitive data** checkbox.
52
-
4. From the **Fields** dropdown, select one or more fields from which you'd like to hash data and click the **Generate hashing keys** button.
53
-
5. Copy the Private Key to a secure location - **once you finish configuring data hashing, this key cannot be retrieved**.
60
+
3. On the Settings page, select the **Have Segment encrypt sensitive data** checkbox.
61
+
4. From the **Fields** dropdown, select one or more fields from which you'd like to encrypt data and click the **Generate Encryption Keys** button.
62
+
5. Copy the Private Key to a secure location - **once you finish configuring data encryption, this key cannot be retrieved**.
54
63
6. Click **Save**.
55
64
56
65
57
66
> error "Private Key is not recoverable"
58
-
> Segment does not save the private key created during the data hashing setup, and cannot retrieve the key after you add data hashing to your destination. You can generate a new key without un-encrypting and re-encrypting your data using the instructions in the [Configure new key pairs](#configure-new-key-pairs) section.
67
+
> Segment does not save the private key created during the data encryption setup, and cannot retrieve the key after you add data encryption to your destination. You can generate a new key without decrypting your data using the instructions in the [Configure new key pairs](#configure-new-key-pairs) section.
59
68
60
69
61
70
### Configure new key pairs
62
71
63
-
<!---TBD--->
72
+
If you lose access to your initial private key, you can generate a new key pair in the settings tab of your destination. Any data previously encrypted using the previous key pair will remain encrypted.
73
+
74
+
To generate a new key pair:
75
+
1. Open the [My destinations page](https://app.segment.com/goto-my-workspace/destinations){:target="_blank”} in the Segment app.
76
+
2. Select a destination, and click **Settings**.
77
+
3. On the Settings page, deselect the **Have Segment encrypt sensitive data** checkbox.
78
+
79
+
<!---todo: after test env access, verify steps beyond step #3--->
80
+
81
+
### Remove encryption
82
+
83
+
Disabling the **Have Segment encrypt sensitive data** setting removes encryption on all data that comes into a source after
84
+
85
+
To remove encryption from future data coming into a destination:
86
+
1. Open the [My destinations page](https://app.segment.com/goto-my-workspace/destinations){:target="_blank”} in the Segment app.
87
+
2. Select a destination, and click **Settings**.
88
+
3. On the Settings page, deselect the **Have Segment encrypt sensitive data** checkbox.
89
+
4. On the **Turn off data encryption?** popup, click **Confirm**.
90
+
91
+
> success ""
92
+
> Disabling the data encryption setting does not decrypt data that is already in the destination, but does prevents any future data from being encrypted.
0 commit comments