By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: Evaluating Cloud Hosting Providers with the FedRAMP
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > eHealth > Evaluating Cloud Hosting Providers with the FedRAMP
eHealth

Evaluating Cloud Hosting Providers with the FedRAMP

onlinetech
onlinetech
Share
4 Min Read
SHARE

While the FedRAMP (Federal Risk and Authorization Management Program) is intended for government entities and their criteria and processes for assessing and monitoring cloud products/services, it’s still a good security standard model that many organizations could follow to minimize security risks in the cloud.

Contents
  • Security Assessment
  • Ongoing Assessment and Authorization

The most applicable standards used for evaluating cloud hosting providers includes:

While the FedRAMP (Federal Risk and Authorization Management Program) is intended for government entities and their criteria and processes for assessing and monitoring cloud products/services, it’s still a good security standard model that many organizations could follow to minimize security risks in the cloud.

The most applicable standards used for evaluating cloud hosting providers includes:

More Read

Twitter Moves Markets: Can It Impact Disease?
Best Practices for Proxy Data Access
‘OK Glass, Start Patient Record’ Tech That Changes The Patient Dialog
Intensive Care Gets Safer With the Help of Tablets
If Meaningful Use Disappeared, How Would EHR Vendors Change Their Products?

Security Assessment

Documenting security controls is the first step that any organization should require of their cloud provider – this includes:

  • Document the controls implemented in the cloud and the cloud environment.
  • Policies around user behavior – with details around use and access.
  • An IT contingency plan – a disaster recovery plan that defines how the organization intends to recover information system services and manage disruptions.
  • Configuration management plan – a plan describing how changes to the system are managed and tracked.
  • Incident response plan – similar to breach notification clauses that should be included in any business associate agreement, for healthcare organizations concerned with HIPAA, an incident response plan outlines how incidents are detected, reported, escalated, handled and remediated.
  • Any authentication that will be used in the cloud, including a required authentication level – two-factor authentication is one method that may be easily employed to create an additional layer of security.
  • Privacy impact assessment – this should document what kind of personally identifiable information (PII), or protected health information (PHI), is collected and if it’s properly safeguarded.

In addition to documentation, this step includes performing security testing, which requires the cloud provider to contract with an accredited third party auditor to test the security of the cloud provider’s system and environment, produce a report of results, and document a plan of action to remediate or change their system to meet security requirements.

As a cloud provider that needs to balance both security and compliance for our clients, Online Tech has contracted a third party auditor to test its controls against a variety of compliance standards, including HIPAA compliance, PCI DSS Compliance, SOX compliance and more on a continuous basis. Read about what each standard means in our Data Center Standards Cheat Sheet.

Ongoing Assessment and Authorization

This refers to the continuous monitoring of cloud providers to ensure their security controls remain effective over time.

  • Operational visibility refers to the transparency of security control implementations – annual self-attestation reports can help in this area.
  • Change control process – establishing a process to track any changes that could impact the ability of a cloud provider to meet security requirements. This also includes changes in a cloud provider’s management.
  • Incident response – keeping track of any new risks or vulnerabilities that might affect authorized system and response/mitigation activities.

Following a similar plan can help your organization avoid a data breach and stay safe in the cloud.

Recommended Reading:
Top 5 Tips for Cloud Computing Security
HIPAA Compliant Data Centers – Includes Security Recommendations for the Cloud

References:
FedRAMP Processes from the U.S. General Services Administration
FedRAMP Security Assessment
Performing Security Testing
Document Security Controls

TAGGED:FedRAMPHIT
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Epidemiological Health Benefits
Personal and Epidemiological Health Benefits of Blood Pressure Management
Health
October 13, 2025
Traumatic Brain Injuries
Understanding Traumatic Brain Injuries: What Families Need to Know
Policy & Law
October 10, 2025
Remote Monitoring touchpoints
Remote Monitoring Touchpoints Patients Will Actually Follow
Technology
October 9, 2025
dental care
Importance of Good Dental Care for Health and Confidence
Dental health Specialties
October 2, 2025

You Might also Like

Image
Mobile Health

Do Wearable Health Devices Actually Lead to Better Health?

July 16, 2015
:)
Social Media

Healthcare and Social Media: Ready to Join the Conversation?

November 9, 2011
Medical Records

Post-its and the Practice of Medicine

October 18, 2012

Why Hospitals Need Social Remarketing

August 21, 2015
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?