By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    medicare part d benefits
    Everything that You Need to Know About Medicare Part D
    August 15, 2022
    Best Ways to Boost Your Immune System this Winter
    Best Ways to Boost Your Immune System this Winter
    November 15, 2022
    back pain issues
    Ways to Treat Constant Back Pain
    August 21, 2023
    Latest News
    How Probate Planning Shapes the Future of Your Estate and Family Care
    July 17, 2025
    Beyond Nutrition: Everyday Foods That Support Whole-Body Health
    June 15, 2025
    The Wide-Ranging Benefits of Magnesium Supplements
    June 11, 2025
    The Best Home Remedies for Migraines
    June 5, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    More On Wellness Programs To Improve Health and Reduce Costs
    January 25, 2012
    Privatizing Social Security and Medicare: Who Can Defuse Political Dynamite?
    June 12, 2011
    Study: Risk of Death in Elderly Patients with Dementia Doubled with Some Antipsychotic Medications
    February 26, 2012
    Latest News
    How IT and Marketing Teams Can Collaborate to Protect Patient Trust
    July 17, 2025
    How Health Choices and Legal Actions Intersect After an Injury
    July 17, 2025
    How communities and healthcare providers can address slip and fall injuries with legal awareness
    July 17, 2025
    Let Your Lawyer Handle the Work Before You Pay Medical Costs
    July 6, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: OCR Cloud Computing HIPAA Guidance
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > eHealth > OCR Cloud Computing HIPAA Guidance
eHealth

OCR Cloud Computing HIPAA Guidance

David Harlow
David Harlow
Share
7 Min Read
cloud
SHARE

The latest OCR HIPAA guidance — on cloud computing — will probably not satisfy those who keep calling for an overhaul of HIPAA because it dates from an era when health records were kept on cuneiform tablets. However, they, like the rest of us, will have to learn to live with the latest guidance. Like other OCR publications (e.g., guidance on ransomware, on precision medicine, on de-identification), the cloud computing guidance will be variously seen as either simply applying existing regulations to new circumstances, or extending previously promulgated regulations in a manner not contemplated when the regs were written. Given the agency’s authority to interpret and apply the regs, and the reality that a new health data privacy and security framework is not about to be promulgated, we need to play the hand we’ve been dealt, we need to understand and implement these guidelines in order to operate in a compliant manner. Most of what is found in the guidance should come as no surprise to anyone who has thought about the intersection of cloud computing and healthcare, though there a few items that warrant further contemplation. First, the unremarkable:

  • A cloud storage provider (CSP) is a business associate (BA). No “conduit” exception.
  • A covered entity (CE) that contracts with a CSP BA needs to understand the cloud environment and services offered so that the CE can conduct its own risk analysis — and the BA needs to conduct its own risk analysis as well. (For purposes of this post, “CE” will include business associates and subcontractors — anyone “upstream” from the CSP)
  • Just because one party (CE or BA) is nominally responsible for a security control (e.g., user authentication to limit access to authorized users) doesn’t mean the other party has no responsibility for the same control (e.g., a CSP BA is responsible for execution of security controls to address a potential malicious actor even where the CE is responsible for authenticating access to its authorized users).
  • A CE must have a BAA in place before using a CSP to process or store PHI.
  • A CSP that meets the definition of a BA is subject to HIPAA whether or not it signs a BAA (though OCR recognizes that a BA may not have knowledge of a CE’s using its resources for PHI and compliance requirements are only triggered by the BA’s knowledge of the violation (actual or constructive), unless ignorance was due to the BA’s willful neglect).
  • PHI in the cloud may be accessed by CEs using mobile devices.
  • A CSP that receives only de-identified data from a CE is not a BA. (Important to remember: encrypted PHI is still PHI; de-identified PHI is not PHI.)

Then, the things that might make you stop and think:

  • “No-view” CSPs (i.e., CSPs that handle encrypted data only and do not have access to decryption keys) are still BAs and must still comply with certain HIPAA requirements. Many, if not most, of the big players in this space require customers to encrypt their data (thus reducing — but not eliminating — the CSP’s regulatory exposure). The guidance does not break new ground here but highlights the general principle that the HIPAA regs are not one-size-fits-all, and are flexible and scalable to address the circumstances of the no-view BA. Take note of these observations on encryption, though:

Encryption does not maintain the integrity and availability of the ePHI, such as ensuring that the information is not corrupted by malware, or ensuring through contingency planning that the data remains available to authorized persons even during emergency or disaster situations. Further, encryption does not address other safeguards that are also important to maintaining confidentiality, such as administrative safeguards to analyze risks to the ePHI or physical safeguards for systems and servers that may house the ePHI.

  • CEs should be sure to review CSPs’ service level agreements (SLAs), to ensure that the CSP does not limit the ability of the CE to comply with HIPAA and that the SLA is consistent with the BAA. OCR notes that SLAs may address HIPAA-relevant issues such as:
    • System availability and reliability;
    • Back-up and data recovery (e.g., as necessary to be able to respond to a ransomware attack or other emergency situation);
    • Manner in which data will be returned to the customer after service use termination;
    • Security responsibility; and
    • Use, retention and disclosure limitations.

Even a no-view CSP BA has to ensure that it does not impermissibly block or terminate access for its CE customer because it may only use or disclose PHI as permitted by the Privacy Rule.

  • CSP BAs must notify CEs of security incidents even where the PHI in their possession is encrypted.
  • The rules do not require that PHI is stored on CSP servers within the US, but location should be considered as part of risk analysis and risk management. As a practical matter, key issues to consider are the likelihood of successful malware attacks or other exploits at the overseas data center and ease of enforcement of legal rights in the overseas court system. Given these issues, it makes sense in most cases to keep US health data on US servers. (As an aside, for US-based CEs with international customers, it is important to review the applicable law in the data subject’s home country; some may require, rather than simply encourage, data storage within their borders.)
Share This Article
Facebook Copy Link Print
Share
By David Harlow
Follow:
DAVID HARLOW is Principal of The Harlow Group LLC, a health care law and consulting firm based in the Hub of the Universe, Boston, MA. His thirty years’ experience in the public and private sectors affords him a unique perspective on legal, policy and business issues facing the health care community. David is adept at assisting clients in developing new paradigms for their business organizations, relationships and processes so as to maximize the realization of organizational goals in a highly regulated environment, in realms ranging from health data privacy and security to digital health strategy to physician-hospital relationships to the avoidance of fraud and abuse. He's been called "an expert on HIPAA and other health-related law issues [who] knows more than virtually anyone on those topics.” (Forbes.com.) His award-winning blog, HealthBlawg, is highly regarded in both the legal and health policy blogging worlds. David is a charter member of the external Advisory Board of the Mayo Clinic Social Media Network and has served as the Public Policy Chair of the Society for Participatory Medicine, on the Health Law Section Council of the Massachusetts Bar Association and on the Advisory Board of FierceHealthIT. He speaks regularly before health care and legal industry groups on business, policy and legal matters. You should follow him on Twitter.

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
How IT and Marketing Teams Can Collaborate to Protect Patient Trust
Global Healthcare Policy & Law
July 17, 2025
paramedics in surgical gloves and masks
How Health Choices and Legal Actions Intersect After an Injury
Health care
July 16, 2025
a woman giving a key
How Probate Planning Shapes the Future of Your Estate and Family Care
Health
July 16, 2025
a woman with kinesio tapes on her back arm
How communities and healthcare providers can address slip and fall injuries with legal awareness
Health care
July 16, 2025

You Might also Like

Image
Mobile Health

Mobile Health Around the Globe: Sana AudioPulse Screens for Hearing Loss in Infants

October 1, 2012
Image
eHealthNewsTechnology

Telemedicine Coming Soon to a Pharmacy Near You: HealthSpot

May 17, 2012

Health Apps and Real Time Consults

July 19, 2011

Adrenal Pathology Reporting: How to Prevent Errors with Pathology Reporting Software

September 29, 2014
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?