Wow, we handle PHI and this is absolutely not acceptable. Glad we're not using New Relic but I'm terrified of Datadog doing this in the future.
Fully-anonymized PHI can be analyzed on anything but the anonymization process must also be certified to have a reasonably low risk of re-identification when combined with other (arbitrary) datasets.
(source: I used to implement and certify PHI data collection platforms.)
No, it's not. (There are compliance reauirements, both direct and implicit on the HITECH definition of secured PHI, but “certified for PHI” is not one of them, despite marketing myths spread by the private HIPAA certification industry, which pedals certifications without legal meaning.)
> a good way to get sued for all of your dollars x10,
HIPAA penalties are capped at a penalty of $1.5 million per year for violations of any single provision, regardless of number of violations (and $50k per violation).