Guide to cloud hipaa

Guide to the CloudHIPAA CONSIDERATIONSFive Questions to Ask Your Cloud Services Provider | August 2011

Guide to the Cloud HIPAA ConsiderationsSUMMARYHealthcare providers have invested a lot of time and resources into meeting privacy and securitylaws such as the Health Insurance Portability and Accountability Act (HIPAA). Demands on ITresources will continue to grow in preparation for a complete conversion to electronic healthrecords (EHR) by 2015.As a small or mid-sized healthcare provider, you’re in the business of caring for people, nothardware and software. Dealing with everyday IT workloads plus current and impending HIPAAregulations can strain your already overtaxed resources.Cloud services can offer a viable alternative to tackling complex technology issues in-house. Byoutsourcing the management of your IT infrastructure, you free up manpower and budget dollarsto focus on patient care instead of equipment.Some cloud computing providers are experts in maintaining a secure infrastructure. They can offerauditable security that is very difficult to achieve in a small hospital or medical practice. If youknow the right questions to ask, you can reap the benefits of the cloud while taking HIPAAregulations into consideration.

Guide to the Cloud HIPAA ConsiderationsFIVE BASIC QUESTIONS TO ASK A POTENTIALCLOUD SERVICES PROVIDER.1. Have you received a Service Organization Controls Report 2 (SOC), formerly known as Statement on Auditing Standards SAS 70 Type II? SAS 70 Type II audits have been the standard for measuring the quality of a cloud service provider’s data center. On June 15, 2011, a new reporting standard went into eﬀect to tighten reporting standards. The Statement on Standards for Attestation Engagements (SSAE) No. 16 replaces SAS 70 Type II. If you are considering a move to the cloud, determine if the provider’s data center has a SAS 70 Type II and is working toward a SOC 2 assessment under the new SSAE No. 16 guidelines. A SOC 2 report shows that the data center has undergone an in-depth audit to evaluate its controls over systems and services, including: • Infrastructure • Software • Personnel • Procedures • Data2. What safety and security measures do you employ at your data center? Cloud service providers should be able to demonstrate that they operate a data center that keeps your information safe and secure. Areas to consider include: • Intrusion Prevention Systems • Data access controls • Reinforced physical security at all data center entry points • Enterprise and private ﬁrewalls • Third-party antivirus monitoring • A network diagram detailing the data center topology The provider should also have a chief security officer on staff who is well-versed in all areas of security and can describe the process in detail to you and your compliance auditor.

Guide to the Cloud HIPAA Considerations3. How can a Cloud Service Provider help manage the security of my data? When considering security in general, the health and maintenance of the underlying IT infrastructure is a good starting point. Cloud service providers can facilitate security for the storage and processing of your data in many ways, including: • Configuring servers using best practices and sourcing hardware and software from leading manufacturers • Installing operating systems and handling patch management • Round-the-clock server and network monitoring • Antivirus installation, configuration and updates • In-house break-fix services • Certified engineers and security professionals on staff4. What is your security policy? Establishing roles and responsibilities upfront is essential to setting expectations for the security of your data. Ask the following: • Who owns the data? The answer should be you. Although the data is kept in the provider’s data center, the data should be entirely under your control. • Who has access to the data and the systems that support it? The provider should be able to tell you how they control access to the facility, operating systems and data. • How do you destroy data, if needed? The data center should practice Department of Defense-level removal of data. Physical drives should be permanently destroyed, not simply tossed away. • How do you notify me if data is lost? The service provider should notify you immediately of suspected data loss that impacts patient information so you can mitigate further risks.

Guide to the Cloud HIPAA Considerations5. What is your Service Level Agreement (SLA)? Server outages interfere with data access, causing significant repercussions when dealing with electronic health records. Ask the cloud service provider to show you their SLA and read the fine print. It should provide details in the areas of: Physical Infrastructure – This clause should include the availability of critical systems like power and cooling, UPS equipment and automatic transfer switches. Hardware –The provider should guarantee proper functioning of their standard hardware components (processors, RAM, hard disks, motherboard, NIC card, etc.) and replace any failed device at no cost within a reasonable period. If you purchased backup services, the provider should also specify how they will restore your data. Network – Network uptime should include the entire network infrastructure, including cabling, switches and routers. Most providers offer a 99.999% uptime guarantee, which equates to 5.26 minutes of downtime annually. A 100% uptime guarantees no downtime. In both cases, the guarantee refers to unscheduled versus scheduled downtime. All providers have scheduled downtime for maintenance, which should occur during weekend hours or overnight. No provider can guarantee that a piece of equipment will never fail, just like you can’t prevent it from happening on your premise. However, the provider’s data center should be resilient and built to respond to failure quickly and efficiently. Summary Data security concerns will become increasingly important as more healthcare providers transition to EHR. The additional strain on resources may lead many toward considering cloud services to offset demands on budget and manpower. By asking providers the right questions, you can reap the benefits of cloud services while meeting your requirements under the law.

Guide to cloud hipaa

by Tom Kirby

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 56

Statistics

Guide to cloud hipaa Document Transcript