06-08-24 | Blog Post
In the past several years, the healthcare industry has undergone a radical transformation in response to technological advances and government regulations. Integrating advanced technologies like artificial intelligence (AI), machine learning, and the Internet of Things (IoT) into healthcare cloud systems enhances data management, predictive analytics, and personalized patient care. For instance, edge computing is emerging as a vital component, improving data collection and analysis for IoT devices in healthcare, which is particularly beneficial for real-time patient monitoring and treatment plans.
Traditionally, healthcare providers and facilities developed their in-house network infrastructure to meet the technological requirements dictated by the Affordable Care Act. However, due to the high costs of building a physical network infrastructure and some constraints imposed by a physical network, an increasing number of healthcare providers are turning to cloud computing. Mordor Intelligence predicts that cloud computing in healthcare will reach a market size of $49.14 billion in 2024, and grow to $83.93 billion by 2029, with a compound annual growth rate (CAGR) of 11.3%. The global healthcare cloud computing market is growing rapidly with no indication of slowing anytime soon.
Some of the ways that cloud computing benefits healthcare providers compared to traditional network infrastructures include:
The Center for Democracy and Technology, a nonprofit public policy organization, shares that:
“Cloud computing can offer increased computing speed, capacity, flexibility, and security at significantly lower cost. Because Cloud Services Providers (CSPs) focus entirely on ensuring reliable, high-availability access to information technology resources, health care organizations (like others) may find that it is substantially cheaper to obtain these resources from CSPs rather than trying to provide them on their own from within their organization.”
While cloud providers have generally been considered and treated as business associates in the industry, recent modifications make it even clearer that data center operators are officially considered business associates and are also directly liable for being compliant with the HIPAA standards that apply to business associates. The federal documentation on the subject states:
A data storage company that has access to protected health information (whether digital or hard copy) qualifies as a business associate, even if the entity does not view the information or only does so on a random or infrequent basis. Thus, document storage companies maintaining 26 protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold. To help clarify this point, we have modified the definition of “business associate” to generally provide that a business associate includes a person who “creates, receives, maintains, or transmits” (emphasis added) protected health information on behalf of a covered entity.
As mentioned in Healthcare Organizations: Seeking a Cloud Provider? BAAs Required, healthcare organizations must be cautious about signing with ‘HIPAA-ready’ or ‘HIPAA certified’ cloud hosting providers. Being ‘HIPAA compliant’ or ‘HIPAA audited’ means they have undergone an independent audit, preferably measured against the latest OCR HIPAA Audit Protocol that outlines each requirement and auditor testing criteria.
If you use a cloud service, it should be your business associate. If they refuse to sign a business associate agreement, don’t use the cloud service. – David S. Holtzman of the Health Information Privacy Division of OCR during a speech at the Health Care Compliance Association’s 16th Annual Compliance Institute.
Another point they make is that business associates must also adhere to the Breach Notification Rule – including the subcontractors of business associates. For an example of a breach notification clause in a business associate agreement (BAA), read our BAA Breach Notification Clause.
Covered entities and business associates should take note – “these proposed changes would make covered entities and business associates liable under § 160.402(c) for the acts of their business associate agents, in accordance 61 with the Federal common law of agency, regardless of whether the covered entity has a compliant business associate agreement in place.”
While business associates and agents are directly liable under HIPAA, covered entities are also directly held responsible for any actions of their business associates and other contractors down the chain of command, making a great case for why it’s important to choose your HIPAA cloud hosting provider carefully. Healthcare Software as a Service (SaaS) companies, EHR providers, and other supporting healthcare vendors need to ensure their cloud Infrastructure as a Service (IaaS) providers undergo annual HIPAA audits, train their staff in security, and have the policies and procedures in place that adhere to security guidelines.
For more information, read our Mobile Security white paper on how to secure electronic protected health information (ePHI) while using mobile devices in the workplace. It is ideal for any healthcare organization interested in implementing a secure BYOD (Bring Your Own Device) environment.
Healthcare organizations can greatly increase their revenue-generating capabilities by pushing infrastructure management to a HIPAA compliant vendor. IT resources can be reallocated to support more end users and development, providing better in-house service of their core applications and increasing development time deployments.
If you’re entrusting protected health information (PHI) to a cloud vendor, choosing an experienced provider gives you assurance that they know what’s specifically required to protect data and applications under health IT law. Check their independent audit reports, history of security and compliance, as well as their ability to provide healthcare client references.
Through our experience, and showcased in our Case Studies, companies chose to colocate their servers with OTAVA® and our HIPAA compliant data centers for a number of reasons:
Our other healthcare case studies provide successful examples of HIPAA compliant cloud, private cloud and colocation solutions for companies faced with IT challenges:
Cyber criminals are being drawn to the healthcare industry like moths to a flame and providers are more vulnerable as the sharing of electronic health records proliferates.
To help diminish both those trends, the Institute for Health Technology Transformation (iHT2) recently compiled its “10 Steps to Maintaining Data Privacy in a Changing Mobile World.”
With a goal of explaining “how healthcare organizations can best protect themselves from the rapidly growing threat of security breaches and medical identity theft,” the paper is compiled by CIOs and security consultants who describe best practices for preventing these incidents and suggesting “how to deal with the proliferation of electronic data on the web and on mobile devices, which has created many new avenues for cyber attacks and the theft of personal health information.”
The paper ends with 10 suggested strategies to follow, each of them worth investigating further. For brevity’s sake, let’s take a look at two of the suggested strategies that are particularly relevant to our secure and compliant data hosting world.
The first deals with something we’ve already covered:
Get business associate agreements. All outside partners and service providers, including cloud storage providers, should sign BAAs acknowledging their responsibility to protect PHI. You should also require business associates to upgrade their security procedures.
A recent Ponemon study revealed that 73 percent of organizations are either “somewhat confident” (33 percent) or “not confident” (40 percent) that their business associates would be able to detect, perform an incident risk assessment and notify their organization in the event of a data breach incident as required under the business associate agreement. … Only 30 percent are “very confident” or “confident” that their business associates are appropriately safeguarding patient data as required under the Final Rule.
To fully manage cloud security risks, we recommend you go beyond business associate agreements and review the provider’s complete policies, procedures and processes. The business associate agreement should outline policies and procedures. Review a copy of your cloud provider’s independent HIPAA audit report, if they invested in one, and check that they’ve been audited against the OCR HIPAA Audit Protocol.
The second suggested strategy deals directly with cloud security:
Choose your cloud provider and cloud type carefully. A cloud service provider should sign a BAA and be HIPAA compliant. Healthcare providers might find the public cloud enticing because of cost efficiencies, but a hybrid cloud might be preferable because it allows them to control their data.
The iHT2 report cites a HIMSS focus group of senior health IT executives that said they are “more comfortable using a private cloud” than a public cloud and were “more likely to store administrative data than clinical data in the cloud.”
The report also cites legal expert John DeGaspari recommending healthcare organizations wanting to use a cloud vendor should make sure the company has a comprehensive set of security procedures. At a minimum, DeGaspari says, the vendor should have third-party certification from an entity such as Services Organization Control (SOC) 2.
OTAVA — which is backed by independent HIPAA, PCI, SOC 2 and Safe Harbor audits — produced its own list of what to look for in a HIPAA cloud provider:
The Center for Democracy and Technology lists specific types of certifications that a healthcare provider should consider when selecting a third party vendor, including:
At OTAVA, we understand the cloud needs of healthcare facilities. We have experts available to work with you in developing a unique cloud solution for your healthcare facility. Contact us today for more information about our services.
References:
HHS: Modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules (PDF)
Related Articles:
HIPAA Hosting Provider BAAs Need to Reflect HHS Final HIPAA Privacy & Security Rules
Does your HIPAA hosting provider have a legal BAA (business associate agreement)? I just got off the phone with our attorneys who are updating our business associate agreement to reflect the changes required in the HHS final HIPAA Privacy and … Continue reading →
