How to Stay HIPAA Compliant with Cloud-Based Software

To safely carry out billing for your private practice, it is imperative that any cloud-based software being used is compliant with the Health Insurance Portability and Accountability Act. Based on a survey done by Bitglass, those in the healthcare industry aren’t as likely to use software based in the cloud. This is due to the fact that they do not fully understand how to use the software in a secure and compliant way. This article will help you to understand the basics of HIPAA compliant cloud storage so you can benefit from its convenience, worry-free.

Protecting Health Information

The Department of Health and Human Services’ Office of Civil Rights released a document in 2016 to provide guidance on HIPAA regulations and cloud computing. The cloud storage provider must have the appropriate controls to adhere to the requirements of the HIPAA Security Rule. If the software is engineered to comply with the rule, security controls will be set in place and there will be little risk of corruption.

Other Important Factors

– Understanding the rules and terminology. The rules “establish certain protections for individually identifiable health information (called protected health information or PHI when created, received, maintained, or transmitted by a HIPAA covered entity or business associate), including limitations on uses and disclosures of information, safeguards again inappropriate uses and disclosures, and individuals’ rights with respect to their health information.” ‘ Covered entities’ (a health plan provider, clearinghouse or health care provider) and ‘business associates’ (an entity or person, not staffed within the covered entity, who provides services to the covered entity) must comply with HIPAA Rules. When a covered entity engages a CSP (cloud service provider) to handle PHI, the CSP is a business associate under HIPAA. “The covered entity (or business associate) and the CSP must enter into a HIPAA-compliant business associate agreement (BAA), and the CSP is both contractually liable for meeting the terms of the BAA and directly liable for compliance with the applicable requirements of the HIPAA Rules. – Patient health information must be encrypted. This is a formatting requirement to ensure that the patient’s information is adequately protected. – It is up to you to determine whether proper safeguards are in place. The existence of potential threats, such as malware attacks and hackers, must be recognized and planned for. You will need to administer a physical safeguard and contingency plan to use if such a thing were to occur. – The private practice’s and it’s IT provider’s responsibilities should be clearly defined in the contract. Keep documentation up to date to make sure that it is clear that the private practice’s responsibility begins after the IT provider has assured you that the cloud-based software is in accordance with HIPAA Rules. If you do not do this, the company you work for could end up with a massive fine. In 2016, the OCR entered a $400,000 HIPAA settlement with Care New England Health System due to an ‘insufficient business associate agreement.’

How To Know Whether Your CSP Is HIPAA Safe

Take these actions to determine whether your CSP is HIPAA safe:

• Perform a risk assessment by categorizing information systems and testing the security control.
• Speak with providers to thoroughly understand how they handle mistakes that commonly occur within cloud security.
• Choose an IT vendor that focuses specifically on security and privacy assets.
• Before talking to service providers, decide how you wish to see your workflow change and make goals so you can choose the correct services to match them.

To protect the private practice you work for, its reputation, and the client’s personal information, you will want to be positive that your software is compliant. We would like to help you with your questions on this issue. If you would like to learn more, please contact our customer service team.