HIPAA Compliance News

Updated Colorado Data Breach Notification Advances: Reporting Period Cut to 30 Days

Posted by HIPAA Journal

In January, a new data breach notification bill was introduced in Colorado that proposed updates to state laws to improve protections for residents affected by data breaches. The bill introduced a maximum time frame of 45 days for companies to notify individuals whose personal information was exposed or stolen as a result of a data breach. The definition of personal information was also updated to include a much wider range of information including data covered by HIPAA – medical information, health insurance information, and biometric data.

Last week, Colorado’s House Committee on State, Veterans, and Military Affairs unanimously passed an updated version of the bill, which has now been passed to the Committee on Appropriations for consideration.

The updated bill includes further new additions to the list of data elements classed as personal information – passport numbers, military, and student IDs. There has also been a shortening of the time frame organizations have to issue notifications. Instead of the 45 days proposed in the original bill, the time frame has been cut to just 30 days following the date of determination that a security breach has occurred.

Typically, when states propose legislation to improve protections for state residents whose personal information is exposed, organizations in compliance with federal data breach notification laws are deemed to be in compliance with state laws.

However, the new bill clarifies that will not necessarily be the case. Healthcare organizations covered by HIPAA laws have up to 60 days to issue notifications to breach victims. The amended bill states that when federal laws require notifications to be sent, the breached entity will be required to comply with the law with the shortest time frame for issuing notices.

That means HIPAA covered entities who experience a data breach that impacts Colorado residents would have half as long to issue notifications.

The original bill required breached entities to issue notifications to the state attorney general within 7 days of the discovery of a breach impacting 500 or more Colorado residents. The amended bill has seen that requirement relaxed to 30 days following the discovery of a breach of personal information. Further, the state attorney general does not need to be notified of a breach if there has been no misuse of breached data or if data misuse is unlikely to occur in the future.

If the new legislation is passed, Colorado residents will be among the best protected individuals in the United States. Only Florida has introduced such strict time scales for sending notifications to breach victims. Colorado residents would also be much better protected when their data is exposed by a healthcare organization, with the time frame for notification cut in half.

The post Updated Colorado Data Breach Notification Advances: Reporting Period Cut to 30 Days appeared first on HIPAA Journal.

Is the Google Cloud Platform HIPAA Compliant?

Posted by HIPAA Journal

Is the Google Cloud Platform HIPAA compliant?  Is the Google Cloud Platform a suitable alternative to Azure and AWS for healthcare organizations? In this post we determine whether the Google Cloud platform is HIPAA compliant and if it can be used by healthcare organizations to build applications, host infrastructure, and store files containing protected health information.

Healthcare organizations are increasingly taking advantage of cloud platforms. The healthcare cloud computing market was valued at $4.65 billion in 2016 and is expected to increase to more than $14.76 billion by 2022.

Amazon AWS is still the leading platform with a market share of 62% according to KeyBlanc, with Microsoft Azure second on 20%, but Google is gaining ground, with a market share of around 12%.

Amazon and Microsoft both offering platforms that support HIPAA compliance, but what about Google? Is the Google Cloud Platform HIPAA compliant?

Will Google Sign a Business Associate Agreement Covering its Cloud Platform?

Since the Omnibus Rule came into effect in September 2013, Google has been signing business associate agreements with HIPAA covered entities for G-Suite and in early 2014, Google extended its BAA to include the Google Cloud Platform.

Google’s BAA now covers most of its cloud services including Compute Engine, Cloud Storage, Cloud SQL for MySQL, Cloud SQL for PostgreSQL, Cloud Dataproc, Genomics, BigQuery, Kubernetes Engine, Container Registry, Cloud Dataflow, Cloud Bigtable, Cloud Pub/Sub, Cloud Translation API, Cloud Speech API, Stackdriver Logging, Stackdriver Error Reporting, Stackdriver Trace, Stackdriver Debugger, Cloud Datalab, Cloud Machine Learning Engine, Cloud Natural Language, Cloud Data Loss Prevention API, Cloud Vision API, Google App Engine, Cloud Load Balancing, Cloud VPN, and Cloud Spanner.

Further, in 2016, a partnership between Google and the backend-as-a-service mobile provider Kinvey saw its mBaaS available on Google Cloud. The mBaaS incorporates connectors to electronic health record systems to support healthcare apps.

Is the Google Cloud Platform HIPAA Compliant?

Google will sign a BAA with HIPAA covered entities, so does that mean the Google Cloud Platform is HIPAA compliant?

The BAA is only one requirement of HIPAA. It means that Google has had its security and data protection mechanisms assessed and they have been found to exceed the minimum requirements of the HIPAA Security Rule. The cloud services offered by Google also meet Privacy Rule requirements, and Google is aware of its responsibilities as a HIPAA business associate. It agrees to provide a secure and HIPAA-compliant infrastructure for the storage and processing of PHI.

However, it is up to healthcare organizations to ensure that HIPAA Rules are followed when using the Google Cloud Platform and that their cloud-based infrastructure and applications are correctly configured and secured.

It is the responsibility of covered entities to disable all Google services not covered by its business associate agreement, access controls must be carefully implemented, controls set up to prevent accidental data deletion, audit log export destinations must be set, and audit logs regularly checked. Care must also be taken to uploading any PHI to the cloud to ensure it is appropriately secured and PHI is not accidentally shared with unauthorized individuals.

While the Google Cloud Platform can be HIPAA compliant, healthcare organization can easily violate HIPAA Rules using Google’s or any other provider’s platform.

The post Is the Google Cloud Platform HIPAA Compliant? appeared first on HIPAA Journal.

Research Institutions Given Additional 6 Months to Comply with Updated Common Rule

Posted by HIPAA Journal

Updates to the Common Rule – The Federal Policy for the Protection of Human Subjects – that were initially due to come into effect on January 19, 2018 have been delayed by 6 months, giving research organizations more time to comply with the new provisions. The new compliance date is July 19, 2018, although the provision covering cooperative research still has a compliance date of Jan 20, 2020.

Several healthcare organizations, including the American Medical Informatics Association (AMIA), the Associated of American Medical Colleges (AAMC), and the Association of American Universities (AAU), called for the compliance date to be pushed back due to uncertainty surrounding the final rule. A delay would allow institutions additional time to ensure compliance and would allow federal agencies more time to issue guidance to researchers to help them implement the updated regulations.

16 federal departments, including the Department of Health and Human Services, made revisions to the Common Rule. In a notice of proposed Rulemaking, the need for the delay to the compliance date was explained. “Without a delay, and without guidance, institutions that have expected a delay who hastily attempt to implement the revised rule without adequate preparation are bound to make mistakes, the consequences of which may jeopardize the proper conduct of research and the safety and wellbeing of human subjects.”

While the delay will be welcomed by many organizations, those that had already prepared to comply with the new provisions of the Common Rule ahead of the January 19 compliance date will now need to continue with their old policies and procedures for a further six months, which may cause some conflicts.

Changes to the Common Rule

The final rule update to the Common Rule was issued on January 19, 2017 on the last day of the Obama administration. One of the main reasons for the update was since the Common Rule was introduced in 1991, there have been many changes to how research is conducted.

At the time, research was mainly conducted in universities and medical institutions, with studies taking place at a single site. Today, the scale of research studies has increased, they often involve multiple sites, data is now digital, and the research is now more diverse. An update to the Common Rule was therefore long overdue.

The changes will improve privacy protections for research participants. The updated Common Rule is closely with the HIPAA Privacy Rule and introduces further safeguards to protect the privacy of research participants, while also improving the availability of health data for secondary research.

The update sees consent requirements changed to require information about research studies to be detailed on consent forms in language that a reasonable person would understand. The changes also make it possible for broad consent for secondary research to be obtained, which will improve the availability of patient-reported data and biospecimens for research.  The changes will also help research institutions obtain up-to-the-minute data from mobile applications and devices used by patients.

The updates clarify that certain public health surveillance activities are exempt from Common Rule restrictions, which will help with monitoring the spread of disease in the United States. Certain low-risk studies conducted by HIPAA Covered entities will also be exempt.

The HHS has also pointed out that the oversight system will not add an unnecessary administrative burden and the update has introduced greater flexibility to match today’s dynamic research environment.

Comments on the Interim Final Rule are being accepted until March 23, 2018 and guidance to help institutions comply with the Common Rule changes will be released over the coming weeks.

The post Research Institutions Given Additional 6 Months to Comply with Updated Common Rule appeared first on HIPAA Journal.

Is SharePoint HIPAA Compliant?

Posted by HIPAA Journal

Is SharePoint HIPAA compliant? Does the platform incorporate all the required administrative and technical controls to meet HIPAA requirements? This post explores whether SharePoint supports HIPAA compliance and its suitability for use in the healthcare industry.

What is SharePoint?

SharePoint is a web-based document management and storage system and one of the leading collaborative platforms on the market, used by 78% of Fortune 500 companies. The platform is based on Microsoft’s OpenXML document standard and therefore integrates seamlessly with Microsoft Office.

SharePoint offers many of the same functions as Google Drive and Dropbox, although SharePoint is a much more powerful platform and can also be used for internet portals, intranet sites and can form the basis of a CRM system.

With such a wide range of functions it is naturally a good fit for healthcare organizations, but is SharePoint HIPAA compliant? Does the platform incorporate all the necessary functions and security controls required by HIPAA?

Is SharePoint Covered by Microsoft’s Business Associate Agreement?

The first question when considering the suitability of a platform for use in healthcare in the United States is whether the platform provider is willing to sign a business associate agreement with a HIPAA covered entity or one of its business associates. Without a BAA, a platform cannot be used in conjunction with any protected health information (PHI).

Microsoft is prepared to sign a business associate agreement with HIPAA covered entities for Office 365 and Yammer, but what about SharePoint?

Microsoft clearly states on its website that SharePoint Online supports HIPAA compliance when used with Office 365 Enterprise, and that its BAA for Office 365 Enterprise does cover SharePoint Online.

Is SharePoint HIPAA Compliant?

Can we consider SharePoint HIPAA compliant? While no software platform can be truly HIPAA compliant, SharePoint does incorporate the necessary administrative and technical safeguards to meet HIPAA Rules and HIPAA covered entities can use the platform in a HIPAA compliant manner.

Microsoft will also ensure that it meets its responsibilities as a business associate, but it is the responsibility of users to ensure that HIPAA Rules are followed and the platform is configured correctly. Covered entities must set access controls for individuals or roles, audit controls must be set, logs must be monitored, appropriate security controls configured, and users must receive training on use of the platform and the restrictions of HIPAA.

Provided a BAA is obtained, the platform is configured and used correctly, SharePoint can be considered a HIPAA compliant document management, document storage, and collaborative platform.

The post Is SharePoint HIPAA Compliant? appeared first on HIPAA Journal.

Is Yammer HIPAA Compliant?

Posted by HIPAA Journal

Is Yammer HIPAA compliant? Does the platform incorporate all the necessary administrative and technical controls to meet HIPAA requirements? This post explores whether Yammer supports HIPAA compliance and assesses whether the platform can be used by healthcare organizations without violating HIPAA Rules.

What is Yammer?

Yammer has been a standalone social networking and collaboration platform since 2008. Its popularity and potential were noticed by Microsoft, which purchased the company in 2012. Today the platform is used by 85% of Fortune 500 companies.

The freemium platform allows company employees to communicate with each other, collaborate on projects, share knowledge, and ask and get quick answers from co-workers.  Due to similarities in its architecture and functionality, it is often referred to as ‘Twitter for companies’.

In contrast to other social media platforms, communications are private and are not published online. The platform can be kept as a strictly internal communication and collaboration tool, although it is also possible to use the platform to communicate with business associates and customers. Via the platform, users can chat and share documents, photos and other files.

Can Healthcare Organizations Sign a Business Associate Agreement for Yammer?

Since January 1, 2016, Yammer has been covered by the Office 365 Trust Center and is covered by Microsoft’s Office 365 enterprise business associate agreement.

Since purchasing the platform, Microsoft enhanced auditing and reporting capabilities. Detailed activity logs are generated giving admins full visibility into how the platform is being used. Through those logs, administrators can audit users, groups, files, admins, network settings, and see all activities on the platform. The logs meet the HIPAA security standard for audit controls.

The HIPAA security standard for access controls is also satisfied. Users get their own accounts and are logged in through their existing organization credentials. Access is only possible with a valid company email address.

All data in transit into and out of the production environment is encrypted, as is data at rest. Microsoft uses AES 256-bit key encryption to ensure data security.

The platform was designed as multitenant, so an organization’s data is logically separated from other companies using the platform and is kept private.

Is Yammer HIPAA Compliant?

So, is Yammer HIPAA compliant? The answer is yes and no.

Microsoft has incorporated all the necessary controls to ensure Yammer can be HIPAA compliant, but HIPAA compliance depends on the organization and its users. Provided risks are identified and managed and healthcare organizations enter into a business associate agreement with Microsoft that covers Yammer – prior to the service being used in connection with any ePHI – Yammer can be considered to be a HIPAA compliant collaboration tool.

The platform must also be configured correctly, policies need to be developed covering the use of the platform, and staff will need to be trained on Yammer and HIPAA restrictions.

The post Is Yammer HIPAA Compliant? appeared first on HIPAA Journal.

What Covered Entities Should Know About Cloud Computing and HIPAA Compliance

Posted by HIPAA Journal

Healthcare organizations can benefit greatly from transitioning to the cloud, but it is essential to understand the requirements for cloud computing to ensure HIPAA compliance.

In this post we explain some important considerations for healthcare organizations looking to take advantage of the cloud, HIPAA compliance considerations when using cloud services for storing, processing, and sharing ePHI, and we will dispel some of the myths about cloud computing and HIPAA compliance.

Myths About Cloud Computing and HIPAA Compliance

There are many common misconceptions about the cloud and HIPAA compliance, which in some cases prevent healthcare organizations from taking full advantage of the cloud, and in others could result in violations of HIPAA Rules.

Some of the common myths about cloud computing and HIPAA compliance are detailed below:

Use of a ‘HIPAA compliant’ cloud service provider will ensure HIPAA Rules are not violated

False: A cloud service provider can incorporate all the necessary safeguards to ensure the service or platform can be used in a HIPAA compliant manner, but it is the responsibility of the covered entity or business associate using the service to ensure that HIPAA Rules are followed. CSPs will not accept liability for misuse of their service/platform or misconfigurations by healthcare employees.

Cloud service providers are classed as conduits and a BAA is not required

False: Cloud services providers are considered business associates (see below) even if they do not – or cannot access stored data. The failure to enter into a business associate agreement prior to using the platform or service in connection with ePHI is a serious violation of HIPAA Rules.

A business associate agreement is required before de-identified PHI can be stored in the cloud

False: There are no HIPAA Privacy Rule restrictions covering the use or storage of de-identified PHI. De-identified PHI is not considered to be protected health information.

Physicians cannot use mobile devices to access ePHI stored in the cloud

False. There is nothing in HIPAA Rules that prevents the use of mobile devices for accessing data stored in the cloud, provided administrative, technical, and physical safeguards are in place to ensure the confidentiality, integrity, and availability of PHI for any data stored in the cloud or downloaded to a mobile device.  However, some healthcare organizations may have internal policies prohibiting the use of mobile devices with cloud services.

Cloud service providers must retain PHI for 6 years

False: HIPAA-covered entities must retain PHI for 6 years, but that rule does not apply to cloud service providers. If a HIPAA covered entity stops using a cloud service, all stored data must be returned to the covered entity or should be permanently deleted. If the CPS is required to retain stored data to meet the requirements of other laws, the information must be returned or deleted when that time period has elapsed.

A cloud service provider cannot be used if data is stored outside of the United States

False: A cloud service provider can store data on servers located in any country. There are no geographical restrictions. However, HIPAA covered entities should assess the risks – by means of a risk analysis – before using such a cloud service, as data stored on servers overseas may not be subject to the same level of protection as data stored on U.S-based servers.

Cloud Service Providers and Business Associate Agreements

While cloud service providers have long been known to be HIPAA business associates, the introduction of the HIPAA Omnibus Rule in 2013 made this clearer. “A data storage company that has access to protected health information (whether digital or hard copy) qualifies as a business associate, even if the entity does not view the information or only does so on a random or infrequent basis.”

The HIPAA conduit exception rule does not apply to cloud service providers. Companies are only considered ‘conduits’ if they offer a transmission only communication services when access to communications is only transient in nature. Cloud service providers are not considered to be conduits, even if the service provider encrypts all data and does not hold the keys to unlock the encryption.

Consequently, a business associate agreement must be entered into with the cloud platform or service provider before the platform or service is used for storing, processing, or transmitting ePHI.

If the cloud service is only ever used for sharing or storing de-identified PHI, a BAA is not required. De-identified PHI is no longer PHI, provided all identifiers have been stripped from the data. (See deidentification of PHI for further information.)

Cloud Computing and HIPAA Compliance

Cloud computing and HIPAA compliance are not at odds. It is possible to take advantage of the cloud and even improve security, but there are important considerations for any healthcare organizations considering using cloud services for storing, sharing, processing, or backing up ePHI

Risk Analysis and Risk Management

Prior to the use of any cloud service it should be subjected to a risk assessment. HIPAA-covered entities and their business associates must conduct their own risk analysis and establish risk management policies.

Business Associate Agreements

Before any cloud platform or service is used in connection with ePHI, the service provider and covered entity must enter into a HIPAA-compliant business associate agreement. The use of a cloud service without a BAA in place is a violation of HIPAA Rules.

Service Level Agreements (SLA)

In addition to a BAA, covered entities should consider a service level agreement (SLA) covering more technical aspects of the service, which may or may not address HIPAA concerns. The service level agreement can cover system uptime, reliability, data backups, disaster recovery times, customer service response times, and data return or deletion when the BAA is terminated. The SLA should also include the penalties should performance fall short of what has been agreed.

Encryption

Any data shared via the cloud should be protected by end-to-end encryption, and any data stored in the cloud should be encrypted at rest. Full considerations should be given to the level of encryption used by the CSP, which should meet NIST standards. While encryption is important, it will not satisfy all Security Rule requirements and will not maintain the integrity of ePHI nor ensure its availability.

Access Controls

Covered entities must ensure that access controls are carefully configured to ensure that only authorized individuals are able to access ePHI stored in the cloud. Prior to the use of any cloud platform or service, the administrative and physical controls implemented by the cloud service provider should be carefully evaluated.

Data Storage Locations

Covered entities should determine the locations where data is stored and risks associated with those locations should be evaluated during the risk analysis. Cloud service providers often store data in multiple locations to ensure fast access and rapid data recovery in the event of disaster. Data protection laws in foreign countries may differ considerable from those in the U.S.

Maintaining an Audit Trail

Healthcare organizations must have visibility into how cloud services are used, who is accessing cloud data, failed attempts to view cloud resources, and files that have been shared, uploaded, or downloaded. An audit trail must be maintained and logs should be reviewed regularly.

Cloud Benefits for Healthcare Organizations

Some of the key benefits for healthcare organizations from transitioning to the cloud are detailed below:

  • Linking a public cloud with data centers allows healthcare organizations to increase capacity without having to invest in additional hardware
  • The cloud is highly scalable – Capacity can be easily increased to meet business demands
  • Healthcare organizations can improve security by avoiding transporting ePHI on portable devices such as zip drives, portable hard drives, and laptop computers. The loss and theft of portable devices is a major cause of HIPAA data breaches
  • The cloud makes sharing ePHI with partners, patients, and researchers easier and faster
  • An unlimited number of data backups can be stored in the cloud. Data can be recovered quickly in the event of disaster
  • The cloud can help healthcare organizations decommission legacy infrastructure and improve security
  • The cloud allows healthcare organizations to reduce their data center footprints
  • Healthcare data can be securely accessed by authorized individuals in any location
  • The cloud allows healthcare organizations to offer and improve their telehealth services
  • The cloud supports the creation of an edge computing system to reduce latency and speed up data access

Choosing a Cloud Partner

While there are many cloud service providers that are willing to work with healthcare organizations, not all are prepared to accept liability for data breaches or violations of HIPAA Rules. Any CSP that will not sign a BAA should be avoided; however, not all cloud companies offer the same level of protection for stored and transmitted data. Willingness to sign a BAA is no guarantee of the quality of the service.

It is essential for a HIPAA covered entity to carefully assess any cloud service, even if the company claims it supports HIPAA compliance.

HIPAA-Compliant Cloud Platforms and Cloud Services

Over the coming weeks we will be assessing the services of a wide variety of cloud service providers to determine whether their platforms support HIPAA compliance.

For further information on specific vendors and to find out if they offer platforms that support HIPAA compliance, visit the links below:

Cloud Platforms

Cloud-Based Services

The post What Covered Entities Should Know About Cloud Computing and HIPAA Compliance appeared first on HIPAA Journal.

Is Zoom a HIPAA Compliant Video and Web Conferencing Platform?

Posted by HIPAA Journal

Zoom is a popular video and web conferencing platform that has been adopted by more than 750,000 businesses, but is the service suitable for use by healthcare organizations for sharing PHI. Is Zoom HIPAA compliant?  

What is Zoom?

Zoom is a cloud-based video and web conferencing platform that allows workers across multiple locations to take part in meetings, share files, and collaborate. The platform supports webinars and includes a business IM service.

Zoom has already been adopted by many healthcare organizations around the globe who use the platform to consult with other providers and communicate with patients. However, in the United States, healthcare providers must comply with HIPAA Rules.

Any software solution must incorporate a host of security protections to ensure protected health information (PHI) is safeguarded. Further, cloud-based platform providers are classed as a business associates and are also required to comply with HIPAA Rules if their platforms are to be used in conjunction with PHI.

Zoom and HIPAA Compliance

As a business associate, Zoom would be required to enter into a contract with a HIPAA covered entity before its service can be used with ePHI. That contract – a Business Associate Agreement – serves as a confirmation that Zoom is aware of its responsibilities with regards to the privacy and security of PHI.

Zoom is prepared to sign a business associate agreement with healthcare organizations and has ensured that its platform incorporates all of the necessary security controls to meet the strict requirements of HIPAA.

In April 2017 Zoom announced that it had launched the first scalable cloud-based telehealth service for the healthcare industry. Zoom for Telehealth allows enterprises and providers to communicate easily with other organizations, care teams, and patients in a HIPAA compliant manner.

The service incorporates access and authentication controls, all communications are secured with end-to-end AES-256 bit encryption, and the platform integrates with the Epic electronic health record system to support healthcare workflows.

This year Zoom announced that it has partnered with a global telehealth integrator and that its platform has been further enhanced to support full enterprise healthcare workflows.

Is Zoom HIPAA Compliant?

Zoom is a HIPAA compliant web and video conferencing platform that is suitable for use in healthcare, provided a HIPAA-covered entity enters into a business associate agreement with Zoom prior to using the platform.

It is still possible for HIPAA Rules to be violated using the platform so users must be aware of their responsibilities with respect to patient privacy, and must only share or communicate PHI with individuals authorized to receive the information. It is the responsibility of the covered entity to ensure Zoom is used correctly and HIPAA Rules are always followed.

The post Is Zoom a HIPAA Compliant Video and Web Conferencing Platform? appeared first on HIPAA Journal.

Is WebEx HIPAA Compliant?

Posted by HIPAA Journal

Is WebEx HIPAA compliant? Is the online meeting and web conferencing platform suitable for use by healthcare organizations or should the service be avoided? In this post we assess the security controls and features of the platform and determine whether use of WebEx could be considered a HIPAA violation.

What is WebEx?

WebEx is a web and video conferencing and collaboration platform that helps businesses connect with remote workers and partners as if they are in the same room.

With tools such as WebEx, healthcare organizations can communicate quickly and easily with the workforce, no matter where employees are located. Regional operational meetings can be conducted, medical education can take place online, and healthcare employees can be trained on new processes and procedures. These platforms can also potentially be used for communicating with patients.

However, before any collaboration tools can be used in connection with protected health information (PHI), healthcare organizations must be certain that the tools support HIPAA compliance. So how does WebEx fare in this regard? Is WebEx HIPAA compliant or should the platform be avoided by HIPAA-covered entities?

WebEx Security

Cisco has implemented a host of security controls to ensure all communications take place securely and information cannot be intercepted. Any information sent from a WebEx application to the WebEx cloud occurs through an encrypted channel which supports TLS 1.0, 1.1 and 1.2 protocols and uses high strength ciphers such as AES-256. Media packets are encrypted using AES 128. There is also the option of end-to-end encryption, which if applied, means Cisco will not decrypt any media streams.

All media streams can be recorded for future reference and meet HIPAA audit requirements. Data is also protected at rest with encryption and audio, video, and data streams are stored separately.

Administrators can configure the platform to provide the desired level of security, including rate limiting on login attempts, the automatic deactivation of accounts after a defined period of inactivity, password policies can be enforced, 2-factor authentication can be used, and strict access controls set to carefully control who has access to the platform.

Cisco also provides full documentation on functionality, technology, and security to help healthcare organizations with their risk assessments.

Cisco will also sign a business associate agreement with HIPAA covered entities and their business associates.

Is WebEx HIPAA Compliant?

WebEx incorporates administrative and technical safeguards that meet HIPAA requirements; however, it is up to covered entities to ensure the platform is configured correctly and that it is used in a manner compliant with HIPAA Rules.

Provided that is the case, and a business associate agreement has been entered into with Cisco covering the use of WebEx for Healthcare, WebEx is HIPAA compliant and can be used by healthcare organizations.

The post Is WebEx HIPAA Compliant? appeared first on HIPAA Journal.

Is Amazon CloudFront HIPAA Compliant?

Posted by HIPAA Journal

Is Amazon CloudFront HIPAA compliant and can the web service be used by HIPAA covered entities without violating HIPAA Rules? In this post we determine whether Amazon CloudFront supports HIPAA compliance or if it should be avoided by HIPAA-covered entities.

What is Amazon CloudFront?

Amazon CloudFront is a web service that allows users to speed up web content delivery over the Internet. Typically, when a website is accessed, the visitor experiences some latency accessing static and dynamic content.

The reason for this is visitors will not make a direct connection to the content, instead they will be routed through a path to reach the server where the content can be accessed. The path can involve many routing points, will inevitably have an impact on the speed at which content can be accessed. By using a content delivery network such as Amazon CloudFront, it is possible to reduce latency and improve reliability and availability of web content.

By delivering content via a network of data centers (edge locations), users are routed to the nearest location with the least latency, thus speeding up their connection. The service also offers a level of protection against DDoS attacks and other cyberthreats that can be harmful to web services.

Is Amazon CloudFront HIPAA Compliant?

In order for any cloud service to be used in conjunction with protected health information, HIPAA-covered entities must enter into a business associate agreement with the service provider. Therefore, before Amazon CloudFront can be deployed, a HIPAA-compliant business associate agreement must be obtained.

Recently, Amazon has updated its HIPAA compliance program and CloudFront has now been included as a HIPAA-eligible service. CloudFront is now included in the list of services covered by the business associate agreement provided for AWS. If you have already executed a BAA for AWS, it is possible to use CloudFront to deliver content containing PHI. However, make sure you check that your BAA specifically states CloudFront is covered.

The service should also be configured to log CloudFront usage data for auditing purposes for HIPAA-compliant workloads. Access logs should be enabled on the platform and requests sent to the CloudFront API should be captured.

Provided a BAA has been obtained for AWS – that includes CloudFront – and the solution is configured correctly, Amazon CloudFront is HIPAA compliant and can be used by healthcare organizations without violating HIPAA Rules.

The post Is Amazon CloudFront HIPAA Compliant? appeared first on HIPAA Journal.