By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    physical health
    5 Ways Playing Games Can Improve Neural and Physical Health
    September 9, 2022
    Reasons For Hair Loss and Its Treatment
    Reasons For Hair Loss and Its Treatment
    February 16, 2022
    healthcare organization
    5 Actionable Strategies For Healthcare Organizations
    August 15, 2022
    Latest News
    Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
    May 16, 2025
    Learn how to Renew your Medical Card in West Virginia
    May 16, 2025
    Choosing the Right Supplement Manufacturer for Your Brand
    May 1, 2025
    Engineering Temporary Hospitals for Extreme Weather
    April 24, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    email marketing in healthcare
    Harnessing the Power of Email Marketing in Healthcare
    October 26, 2023
    healthcare claims
    The Role of Communication in Resolving Complex Workers’ Compensation Claims in Healthcare Settings
    September 22, 2024
    Wounds and Wisdom: What Motorcycle Accidents Teach Us About Health and Healing
    Wounds and Wisdom: What Motorcycle Accidents Teach Us About Health and Healing
    February 12, 2025
    Latest News
    Building Smarter Care Teams: Aligning Roles, Structure, and Clinical Expertise
    May 18, 2025
    The Critical Role of Healthcare in Personal Injury Recovery: A Comprehensive Guide for Victims
    May 14, 2025
    The Backbone of Successful Trials: Clinical Data Management
    April 28, 2025
    Advancing Your Healthcare Career through Education and Specialization
    April 16, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: What Is HIPAA Compliant Hosting?
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Business > Hospital Administration > What Is HIPAA Compliant Hosting?
BusinessHospital AdministrationPolicy & Law

What Is HIPAA Compliant Hosting?

morgan_truevault
Last updated: February 6, 2019 7:51 pm
morgan_truevault
Share
7 Min Read
HIPAA-compliant hosting
SHARE

 

According to security guidelines established by HIPAA (the Health Insurance Portability & Accountability Act), it’s not only covered entities—that’s those who provide treatment, payment, and operations in healthcare—but also their business associates—that’s anyone who develops mHealth, eHealth, or wearable applications that deal with Protected Health Information (PHI)—who are required to meet national standards for Physical, Administrative, and Technical security of health information.

When it comes to keeping protected data secure, there’s no denying that apps that will be transmitting, storing, or managing PHI should be using HIPAA compliant hosting. But what does it mean for a hosting provider to be HIPAA compliant? And, more importantly, does using HIPAA compliant hosting guarantee the app itself will be HIPAA compliant?

The HIPAA Security Rule calls for the following three safeguards to be met in order to be in compliance.

More Read

How Should We Choose Health Insurance Policy for Senior Citizens?
The Role Of Nutrition In Recovery From Alcohol And Drug Addiction
Amazing Hospital Technologies that Improve Patient Care in 2025
What’s In Your Energy Drink?: Infographic
Verizon, WellPoint, CVS, Walgreens Ally with Former Senators to Push Telehealth Policy Reform
  • Administrative Safeguards
  • Technical Safeguards
  • Physical Safeguards

Typically, HIPAA hosting only meets the Physical Safeguard requirements, meaning HIPAA hosting alone does not make your app HIPAA compliant.

All hosting providers who handle HIPAA protected data are required to sign a Business Associate Agreement which ensures that service providers use, safeguard, and disclose personally identifiable patient information properly.

Furthermore, HIPAA compliant hosting providers must implement the Physical Safeguard Requirements dictated by the HIPAA security rule, including:

  • Workstation Use — They have policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI.
  • Workstation Security — They implement physical safeguards for all workstations that access ePHI and the hardware or electronic media on which it is stored.
  • PHI Disposal — They implement policies and procedures that address the ultimate disposal of ePHI and the hardware or electronic media on which it is stored.
  • Media Re-Use — They follow procedures for removal of ePHI from electronic media before the media are made available for re-use.

Required specifications like the ones above must be implemented by each and every company that deals with HIPAA information. In addition to the above specifications, however, there is also a list of addressable HIPAA specifications, which must be implemented if it is reasonable and appropriate to do so.

Addressable specifications include:

  • Accountability — They maintain a record of the movements of hardware and electronic media and any person responsible therefore.
  • Data Backup and Storage — They create a retrievable, exact copy of ePHI, when needed, before movement of equipment. Contingency Operations — They establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.
  • Facility Security Plan — They implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.
  • Access Control and Validation Procedures — They implement procedures to control and validate a person’s access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.
  • Maintenance Records — They implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (e.g. hardware, walls, doors, and locks).

The addressable specifications are far from optional, and companies must document their choice whether or not to address them along with the logic behind it. In general, however, HIPAA hosting companies should and do implement the addressable physical specifications in addition to required physical specifications, as they are best practices that ultimately contribute to the security of sensitive data.

While there’s no question about whether app developers should use HIPAA compliant hosting, that’s just one—admittedly important and often costly—step toward ensuring that software solutions meet HIPAA requirements. In and of itself, however, HIPAA compliant hosting does not ensure HIPAA compliance of the app as a whole.

HIPAA compliant hosting only meets the Physical Safeguard requirements of HIPAA. Though these safeguards protect the security of data, including data redundancy and failure requirements, access to servers, and more, they are only a piece of the puzzle.

In addition to the Physical Safeguards discussed above, there are important Administrative and Technical Safeguard requirements that must be met as well. HIPAA hosting by definition cannot offer Administrative Safeguards, since these are dictated by the policies and procedures individual companies implements to ensure proper employee management, training, and oversight for staff who come into contact with protected health information.

As for Technical Safeguards—which include features like encryption and decryption, audit controls, emergency access procedures, and HIPAA file storage—most HIPAA hosting providers do not offer these necessary safeguards.

Nevertheless, many developers erroneously believe that using HIPAA compliant hosting automatically guarantees HIPAA compliance. This false sense of security can be dangerous as well as costly, since a single HIPAA violation can result in penalties of up to $50,000 (with an annual maximum of $1.5 million) Additional breach penalties can push violation totals far higher.

For this reason, it’s important that software is compliant to Physical as well as Technical HIPAA security requirements.

HIPAA / shutterstock

TAGGED:HIPAApatient privacy
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Clinical Expertise
Building Smarter Care Teams: Aligning Roles, Structure, and Clinical Expertise
Health care
May 18, 2025
Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
Grounded Healing: A Natural Ally for Sustainable Healthcare Systems
Health
May 15, 2025
Learn how to Renew your Medical Card in West Virginia
Learn how to Renew your Medical Card in West Virginia
Health
May 15, 2025
Dr. Klaus Rentrop Shares Acute Myocardial Infarction heart treatment
Dr. Klaus Rentrop Shares Acute Myocardial Infarction
Cardiology
May 13, 2025

You Might also Like

Physician Marketing and wait times
BusinessHospital Administration

Why Wait Times Matter in Physician Marketing

December 1, 2014

Device Companies Renew Interest in Startups

March 12, 2011
healthcare IT
BusinesseHealthHospital AdministrationPolicy & LawTechnology

5 Questions with Dan Haley, VP of Government and Regulatory Affairs at athenahealth

April 17, 2013
Digital Marketing, medical practice
Business

Elements of a Good Digital Marketing Plan for Your Medical Practice

December 19, 2014
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?