Looking for a Business Associate Agreement? Download our FREE starter template.
Total HIPAA Logo

Is Your HIPAA Security Plan for Cloud Computing Bullet-Proof?

When HIPAA laws were first established in 1996, large-scale cloud storage was in its infancy. Today, it would be hard to imagine business without cloud technologies. The HIPAA Privacy and Security Rules don’t directly address how to incorporate them into your compliance plan, however, this is where you could be vulnerable as healthcare data has become increasingly more valuable to hackers.

Some of the most common uses of cloud services include

  • Storing files and retrieving them from any web-enabled interface;
  • Disaster recovery that is faster and more cost-effective than using fixed assets
  • Backup that never runs out of space

Cloud Storage

Cloud storage isn’t something you own, it’s something you use. It is provided by a third party; therefore, selecting the right service provider is of the utmost importance. If you turn to the cloud for these services, here are some of the things to consider if you are transferring or storing ePHI:

  1. Risk Assessment – You should include your cloud storage provider in your HIPAA Risk Assessment. This is an effective way to determine and document that your provider meets all of your HIPAA protocols.
  2. BA Agreement – Your storage provider must be willing to sign and abide by a Business Associate Agreement. If they won’t sign an agreement, it’s time to find a new cloud storage solution. Ask questions that validate the cloud provider understands the need to back-up data, protect the integrity of the information and have it available 24/7.
  3. Encryption – It’s not a question of do they encrypt data, but what standard do they use? Your provider should be using a minimum of 128-bit encryption and encrypt all files in transit, storage and rest. Verify the encryption keys are protected as well. As a best practice, the key management system should split the encryption key between at least two entities.
  4. Logging- Your provider should be able to produce a log of who accessed what files when. This is an important requirement for you to be HIPAA Compliant.
  5. Access Levels- Your provider should allow you to designate access levels for information. Not every employee needs access to every document, and this also allows you to deny access to employees that quit or are terminated.
  6. Audit Report – Cloud storage providers should produce an annual HIPAA audit report conducted by a reputable third party that you can review. Ideally the audit follows the Office of Civil Right HIPAA Audit Protocol.

Cloud computing is a trending solution that makes sense for most most practices and businesses. When used properly, it can help protect the PHI you store, and save you time and money on your path to HIPAA Compliance.

Have more questions about HIPAA Compliance, contact us here.

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)