Get Compliant or Get Out of the Game: HIPAA's No Joke

Attention hosting companies currently supporting healthcare clients: get compliant or get out of the game.

Attention hosting companies currently supporting healthcare clients: get compliant or get out of the game. For those still unaware, cloud hosting and other IT vendors involved with the storage or transmission of healthcare data must meet HIPAA compliance by…two days ago (September 23). So, by the end of the year, at least, for all you laggers. Here’s what happens if you are not compliant, and still continue to serve healthcare clients:

You may be subject to an audit conducted by the federal government;
You could pay some major fines;
You could lose a lot of business;
And if you suffer a data breach (of unencrypted data affecting 500 people or more), you will definitely be subject to all of the above.

And for covered entities (healthcare organizations that deal with protected health information (PHI)), if you’re hosting your data and/or applications with a non-compliant business associate (hosting provider), then you can also be held liable in the event of a data breach. Switch to an audited and compliant HIPAA hosting provider, and you’ll be in the safe zone (note: your organization also needs to maintain compliance; your IT vendor does not make you compliant by proxy).

Cloud vendors can’t really afford to take the risk of supporting healthcare clients without first ensuring they’re operating fully in compliance with HIPAA. And HIPAA is a lot more than just technical security – the standards also require administrative and physical security safeguards. A few examples include:

Administrative Security

Annual audits and reports indicate that business associates are maintaining ongoing compliance, not just a point-in-time
Documented policies and procedures should reflect protocol in the event of a data breach, including notification time
Staff training is specific to business associates and hosting providers on how to handle ePHI (electronic protected health information)

Physical Security

Limited and authorized personnel access to locked servers
Dual factor authentication for building access (we use biometrics; fingerprint ID + badges)
Environmental controls include logged surveillance cameras, 24×7 monitoring and multiple alarm systems

Technical Security

Encryption of data in transit and at rest requires VPNs, SSL, two-factor authentication and hardware-based storage encryption
Daily log review tracks user activity and analyses them to identify any potential issues and patterns
Vulnerability scanning checks for outdated versions of software, web apps that aren’t securely coded, and misconfigured networks

And so much more! The point is, HIPAA compliance is a little more complex as it involves assessing unique organizational structures to ensure there are no security gaps, as well as ongoing maintenance for complete data protection. And if you’re currently using a non-compliant hosting provider to host patient data, you’d better find a new one that is compliant…like yesterday.