Back in the days when healthcare records were stored in giant filing cabinets in manila folders, security was a matter of having strong locks and restricted access. But today, with all of the benefits of electronic health records and cloud storage, matters are a bit more complicated. Healthcare providers have become accustomed to the stringent regulations – and associated penalties – of the Health Insurance Portability and Accountability Act (HIPAA) but now, with new regulations looming, other providers will be forced to align themselves with the latest provisions.

Cloud service providers, in particular, will need to be compliant with HIPAA if they plan to do business with healthcare organizations. Updates to HIPAA expand the definition of “business associates,” who must follow the same guidelines as physicians and insurance providers. In fact, the new rules specifically address cloud providers, stating, “Document storage companies maintaining protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold.”

Compliance Issues

The new HIPAA guidelines introduce a host of compliance issues that must be addressed, and business associates will now be held to the same strict regulatory guidelines as healthcare providers.

• Breach Notifications: One major change involves the adjusted threshold for breach notifications. In the past, notifications were required when a data breach posed “significant risk of reputational, financial or other harm.” Now, however, providers and associates must notify the U.S. Department of Health and Human Services when unsecured data is breached unless a multi-factor risk assessment determines that there is a low risk of exposure.
• Gap Analysis: In order to bring existing policies and procedures in line with the updated regulations, providers and associates should conduct a risk analysis to assess and address any gaps in policies and procedures, in accordance with 45 C.F.R. 164.308(a)(1) of the security rule.
• Adjust Business Agreement: In order to ensure that all parties are aligned with the new provisions, both providers and associates must update and revise existing agreements, utilizing sample business agreements as provided by the Department of Health and Human Services.
• Encryption Technology: As an additional safeguard, all parties should use encryption technology on protected health information, especially on portable devices, bringing a secondary level of security and minimizing the risk of exposure.

With proper training and awareness, both healthcare providers and business associates can ensure compliance with the new regulations, which, according to DHHS, will help avoid potential monetary penalties of more than $1.5 million in some cases.