Is Adobe Embed API HIPAA compliance?

[SahandSoltanieh]

Hi,

My question is whether Adobe Embed API is HIPAA compliance or not?

Thanks,

[Sid.Sidhu · Accepted solution]

Hello @SahandSoltanieh ! Adobe Embed API is not HIPAA compliant currently. Please also note, the Developers may not use Document Cloud Services SDK to collect, process, or store sensitive personal data such as protected health information under HIPAA, children’s personal information under COPPA, and other similar information as described in our General Terms

Thanks!

[SahandSoltanieh]

Thanks for the quick response. Great API, hopefully it'll become HIPAA compliant as well one day.

[Seth5E69]

What information is sent to Adobe by the embed API? My understanding was that the Adobe's embed viewer is a local application (similar to Adobe Reader) for viewing PDFs in a browser. Are there certain features of the embed API that transmit data? Additional details would be appreciated!

[SahandSoltanieh]

Given how the API works, I assume PDF files will be uploaded to Adobe cloud storages in order to be parsed, and then they would be served directly through their servers rather than yours. But I'm not quite sure, I would love to know more about this as well.

[Seth5E69]

I found this in the FAQ (https://community.adobe.com/t5/document-services-apis-discussions/faq-for-document-services-pdf-embe...)

When Adobe Analytics is not enabled by the SuiteID and no other events are enabled, does Adobe collect any data about the PDF being viewed.

• The PDF Embed API  stores user settings in client-side browser's local storage for things such as color for annotation. As far as analytics is concerned, PDF Embed ONLY gathers standard anonymous usage and data parameters like locations, timezone, pdf file lang, file name, file size, no of pages, etc.. It doesn't store any user-generated content in analytics and never shares user-generated content with Adobe servers.

[Seth5E69]

Also found this conflicting information in the Aug release notes: With this patch release, PDF Embed API now no longer gathers anonymous usage data to measure performance. This was earlier collected using Adobe Analytics.

[Sumona Ghosh]

Sorry for the confusion. PDF Embed API gathers only essential anonymous data to gain insights on product usage. Earlier, this was done using Adobe Analytics but we no longer use Adobe Analytics to collect this data.

For more details, please have a look at the documentation.

[Novomedici24233353dg1v]

Hi Sumona,

Thank you for this answer. As PDF Embed API does not send the actual pdf to the Adobe server or any other server ad only work on it at local machine, we do not worry about BAA or HIPAA , is that statement correct ? We are a medical healthcare company looking to integrate the embed PDF platform into our product.

Thank you

Paul