By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    healthcare cybersecurity
    4 Helpful Tips on How to Protect Your Medical Practice Against Cyber Attacks
    October 24, 2021
    Health Check Diagnosis Medical Condition Analysis Concept
    6 Health Woes With Online Remedies
    January 19, 2022
    Eight Things Men Should Know About the Male Menopause
    Eight Things Men Should Know About the Male Menopause
    April 24, 2022
    Latest News
    Beyond Nutrition: Everyday Foods That Support Whole-Body Health
    June 15, 2025
    The Wide-Ranging Benefits of Magnesium Supplements
    June 11, 2025
    The Best Home Remedies for Migraines
    June 5, 2025
    The Hidden Impact Of Stress On Your Body’s Alignment And Balance
    May 22, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    healthy nursing school habits
    Healthy Habits for Nursing Student Nursing School Students
    May 24, 2024
    High Deductables
    High-Deductible Insurance and Rising Bad Debt
    July 24, 2015
    How People Are Taking Advantage of Health Deals in the Recent Recession
    February 5, 2021
    Latest News
    Top HIPAA-Compliant Messaging Apps for Healthcare Teams
    June 25, 2025
    When Healthcare Ends, the Legal Process Begins: What Families Should Know About Probate and Medical Estates
    June 20, 2025
    Preventing Contamination In Healthcare Facilities Starts With Hygiene
    June 15, 2025
    Strengthening Healthcare Systems Through Clinical and Administrative Career Development
    June 13, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: HIMSS 13: HHS Final Ruling Changes the Rules & Roles for HIPAA Hosting
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Policy & Law > Health Reform > HIMSS 13: HHS Final Ruling Changes the Rules & Roles for HIPAA Hosting
Health ReformHospital AdministrationPolicy & Law

HIMSS 13: HHS Final Ruling Changes the Rules & Roles for HIPAA Hosting

onlinetech
Last updated: March 9, 2013 8:49 am
onlinetech
Share
7 Min Read
HIMSS 13 HHS Presentation
SHARE

At HIMSS 13, I attended a session, A Dialogue on HIPAA/HITECH Compliance: Considerations Now That the HITECH Rules Are Here, that revealed insights into real-world applications of the new privacy and security rules, including the practical implications of the final breach notification rule for HIPAA hosting providers, other business associates (BAs) and covered entities (CEs) alike.

At HIMSS 13, I attended a session, A Dialogue on HIPAA/HITECH Compliance: Considerations Now That the HITECH Rules Are Here, that revealed insights into real-world applications of the new privacy and security rules, including the practical implications of the final breach notification rule for HIPAA hosting providers, other business associates (BAs) and covered entities (CEs) alike.

HIMSS 13 HHS Presentation

View the HIMSS13 HHS Presentation (PDF)

The session was presented by Leon Rodridguez, the Director of Office for Civil Rights from the Depart. of Health and Human Services (HHS), the governing body of HIPAA (Health Insurance Portability and Accountability Act) that sets regulatory standards on the healthcare industry to ensure patient data security and privacy. James Wieland, Principal of Ober Kaler Grimes & Shriver Attorneys at Law also presented.

One of the biggest changes that affects HIPAA compliant software and SaaS (software as a service) companies is that their hosting providers are now considered business associates under HIPAA. That means colocation and cloud hosting services that house PHI (protected health information)  now fall under the purview of HIPAA and are subject to civil & criminal penalties of up to $1.5M. These penalties and fines apply whether or not the hosting provider knowingly has PHI on their servers or in their data center.

More Read

Hospital Capacity Management: Interview With GE Performance Solutions (transcript)
Can We Survive an Epidemic of Corporate Wellness?
Echocardiographic in General Population Not Effective in Reducing Death/Disease
Antibiotics for a Virus? How to Just Say “No”
5 Tips To Squeeze Time Out To Exercise During Holidays

The final ruling also makes it clear that healthcare & HIPAA compliant service and software companies must sign a BAA (business associate agreement) with their hosting providers and that the HIPAA compliant service & software companies have ultimate accountability for their hosting provider meeting or not meeting HIPAA requirements.

What Changed?
Before the final ruling, some cloud providers claimed that they were simply “conduits” – only housing, but never accessing PHI on their servers. With the final ruling, HHS made it clear that conduits are considered BAs, subject to HIPAA compliance if they have “persistence of custody” of PHI.

In other words, if PHI data is stored in a data center, or on a cloud server, then the hosting provider is considered a business associate and must be able to demonstrate that they can meet the HIPAA administrative, physical and technical requirements to assure the confidentiality, integrity and availability of electronic PHI.

Leon Rodriguez, Director of HHS’s for Office for Civil Rights made it clear – cloud and colocation providers are BA’s and are subject to criminal & civil penalties if they are not compliant with the law.

What does this mean to CE’s and BA’s that host their PHI at a colocation data center or with a cloud hosting provider?

  1. They must sign a BAA with their hosting provider.
  2. They must assure that their hosting provider is HIPAA compliant.
  3. They must assure that their hosting provider has signed BAAs with their subcontractors.
  4. They continue to hold ultimate accountability under the law if their hosting provider is found to not be compliant – and subject to fines that can reach $1.5M per violation.
  5. The final ruling is effective starting March 26, 2013 and enforcement starts on September 23rd.

Any BAA signed with a provider prior to Jan. 25, 2012 with a hosting provider is grandfathered in and can stand through Sept. 23, 2014.  If you sign a BAA with your hosting or colocation provider after Jan 25th, 2013, your BAA must meet all of the new requirements of the Final Ruling.

Questions to ask your colocation/cloud providers if they are hosting your PHI:

  1. Will you sign a BAA?  Can I get a copy of your BAA for review?
  2. Does your BAA meet the requirements of the HHS final ruling?
  3. Have you signed BAAs with all of your subcontractors?
  4. Have your been audited against HIPAA administrative, physical and technical requirements for security?
  5. Did your audit follow the Office of Civil Rights Audit Protocol?
  6. Can I have a copy of your HIPAA audit report?

To protect yourself and your company from an Office of Civil Rights Audit or Enforcement Action, the answer to all of these questions should be “Yes.”

HIPAA Compliant Hosting White PaperFor more on secure hosting for HIPAA compliant solutions, read our HIPAA Compliant Hosting white paper. Questions to ask your HIPAA hosting provider, data center standards cheat sheet and a diagram of the technical, physical and administrative security components of a HIPAA hosting solution (including HIPAA compliant clouds) are included.

Related Articles:

HIPAA Hosting Provider BAAs Need to Reflect HHS Final HIPAA Privacy & Security Rules
Does your HIPAA hosting provider have a legal BAA (business associate agreement)? I just got off the phone with our attorneys who are updating our business associate agreement to reflect the changes required in the HHS final HIPAA Privacy and … Continue reading →

Final HIPAA Omnibus Rule: Business Associate Agreements & Roadmap to Compliance
In addition to redefining business associates (BAs) and including subcontractors in the scope of liability, the final HIPAA omnibus rule has prompted the release of a new sample business associate agreement by the Dept. of Health and Human Services (HHS). … Continue reading →

How the Final Omnibus Rule Affects HIPAA Cloud Computing Providers
The long-awaited final modifications to the HIPAA Privacy, Security, Enforcement and Breach Rules were introduced Thursday. The 563-word document outlines the changes that were initially slated for implementation last summer (remember the omnibus rule?). So how do these modifications affect … Continue reading →

The post HIMSS 13: HHS Final Ruling Changes the Rules & Roles for HIPAA Hosting appeared first on Managed Data Center News.

TAGGED:HIMSS 13HIPAA Privacy Rules
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

women dental care
What Is a Smile Makeover and How Much Does It Cost?
Dental health
June 30, 2025
HIPAA-Compliant Messaging Apps
Top HIPAA-Compliant Messaging Apps for Healthcare Teams
Global Healthcare Policy & Law Technology
June 25, 2025
recovering from injury
Rebuilding After Injury: Path to Physical and Emotional Recovery
News
June 22, 2025
scientist using microscope
When Healthcare Ends, the Legal Process Begins: What Families Should Know About Probate and Medical Estates
Global Healthcare
June 18, 2025

You Might also Like

Health careMedical EducationMedical Ethics

5 Mistakes that Can Ruin a New Nurse’s Career

August 24, 2018

British National Health Service – HealthCare Within a Budget

September 29, 2011

What the Supreme Court (and You) Won’t Hear About Health Reform

March 25, 2012
Health careWellness

How To Find Back Pain Relief Without The Complications Of Surgery

February 4, 2019
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?