This provider checklist will get you on board with your looming compliance deadline
By Frankie Rios, CCISP
Cloud computing and storage is an undeniable migration path and IT strategy. Overall spending on cloud technology is expected to reach an estimated $150 billion annually by 2014, according to a recent Gartner Group study. And within healthcare, 35 percent of health IT professionals surveyed said their organization was implementing or maintaining cloud computing in 2012, up from 30 percent in 2011 according to a new survey by Vernon Hills, Ill. technology vendor CDW.
However, not every software application in healthcare is a candidate for moving to the cloud. And many old myths about cloud computing and cloud storage continue to confuse both covered entities (CEs) and business associates (BAs).
The HIPAA omnibus rule, released in January 2013, helps to confirm the key areas of protected health information (PHI) privacy and security focus for cloud-based solutions in healthcare. The rule gives healthcare organization a checklist for cloud computing. Compliance with these changes goes into effect this month (March 2013) with full enforcement in September.
Cloud Criteria #1: Risk Assessment
In order to protect themselves, covered entities should perform a risk analysis on all potential cloud vendors. The risk assessment should include policies, privacy and security awareness training, account management, physical security, business continuity, incident response and media disposal. Maintain assessment documents and vendor responses for six years and have them readily accessible should Office of Civil Rights auditors come knocking.
Cloud Criteria #2: Contracts
Review your existing Business Associate Agreements (BAAs) with cloud computing partners and ensure they are updated to comply with HIPAA omnibus. For example, contract language should be specific as to the service, usage and location of the data to be stored in the cloud.
For cloud-based partners using multi-tenant hardware, specific technical and procedural controls for sequestering information by CE or BA should be stated and included in contracts. An indemnity clause must be included stating that the cloud vendor carries enough insurance to cover a breach.
Clout Criteria #3: Audit
Know if the existing or potential cloud vendor has been audited. Do they have a current SSAE report? If there were findings, is there a documented remediation plan? Are regular, internal audits conducted, and is the cloud vendor willing to share the results?
Cloud Criteria #4: Encryption
Does the vendor provide encryption for the communication of information and the data at rest? Encryption is the best way to protect data and prevent breaches. HITECH requires that communication pathways and data storage devices are encrypted. Ask cloud vendors to define their encryption methodologies for both.
Cloud Criteria #5: Business Continuity
Business continuity has always been a must have with cloud-based solutions. Some of the new omnibus requirements make it even more important for CEs and BAs. Questions to answer include:
- How redundant is the vendor's power?
- How many power feeds does the vendor utilize?
- How many internet feeds?
- How often do they perform tests of their systems?
- Do they keep their equipment sufficiently maintained?
Cloud solutions will keep your PHI private, secure, safe and compliance with HIPAA's omnibus rule. Your effective due diligence ensures that they do.
5 Key Changes Under HIPAA Omnibus Rule
Here are important changes under the HIPAA Omnibus Rule:
1. Business associates of covered entities are now directly liable for compliance of certain privacy and security rules.
2. The rule strengthens the limitations on the use and disclosure of PHI for marketing and fundraising, and it prohibits the sale of PHI without individual authorization.
3. It adopts the increased and tiered civil monetary penalty structured by the HITECH Act.
4. It mandates breach notification for unsecured PHI under the HITECH Act.
5. It modifies the HIPAA privacy rule as required by the GINA (Genetic Information Nondiscrimination Act), prohibiting health plans from using or disclosing genetic information.
