Membership Rules for Zoom HIPAA Subaccount

What is it? 

Campus units that are covered by Health Insurance Portability and Accountability Act (HIPAA) rules use a version of Zoom that ensures Private Health Information (PHI) is secure. Employees are currently assigned to this Zoom HIPAA subaccount through a manual process. This project will use Grouper to automatically assign individuals in HIPAA covered units to the appropriate Zoom configuration.  This change aligns with rules already in place in other ITS applications that define who is covered by HIPAA rules. 

Why are we doing it? 

• The Grouper system ensures HIPAA compliance by automatically assigning users to the correct Zoom account if they work in a HIPAA covered unit. 
• Aligning the Grouper rules with those already in use creates a single list of HIPAA covered units for the Privacy Office to access. 
• This project satisfies one of the key prerequisites necessary for implementing additional features in Zoom including the Zoom AI Companion. 

How does this impact our UNC community? 

Faculty and Staff working in HIPAA covered units 

The Zoom HIPAA subaccount has decreased functionality because some features, including automatic backups to Panopto and Zoom AI Companion, are not licensed for Tier 3 data such as PHI.  Employees working in HIPAA covered units will lose access to these features unless they do a one-time attestation stating that they are not sharing PHI.  

When is this happening? 

This project is currently underway, with expected completion in March 2024.