More Data More Security Risks
By Ken Allen, Director of Product Marketing for Ipswitch File Transfer
Twitter: @marketingbyken
Company Twitter: @IpswitchFT
Given the recent Omnibus ruling from September 2013, compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) has never been more urgent. With security breaches occurring at an alarming rate, the push towards compliance has fueled businesses large and small to explore the necessary requirements – and options available – when it comes to achieving HIPAA compliance.
While the healthcare industry has often been slower to adopt cloud architecture compared to other industries, there has been a recent move to cloud technology in order to replace legacy healthcare systems.
Any organization that meets the HIPAA definition of a covered entity or business associate falls under the HIPAA compliance umbrella, regardless of how far removed they are from the point of treatment; they are subject to significant fines and penalties in the event of a breach. These organizations often find themselves asking, “What is the path to compliance?” Well, the path towards compliance starts with performing a HIPAA Security Rule assessment, which can be performed internally, or by an independent, third party assessor.
The requirements (and how the cloud can make meeting them easier)
The HIPAA Security Rule is made up of Administrative, Technical, and Physical Safeguards, as well Organizational and Policy/Procedure Requirements. Each safeguard contains standards and implementation specifications that must be satisfied in order to validate compliance. The resulting compliance assessment of the HIPAA Security Rule focuses on common IT general controls, such as risk management, physical and logical access control, protection from malicious software, disaster recovery, information security policies and procedures, workstation security, and encryption of data in transit and at rest.
This is where cloud-based solutions can provide significant value, as working with compliant service providers can reduce the burden that HIPAA regulations impose on the organization.
One area where a cloud-based solution delivers significant value is file transfer, providing organizations with superior security and control when managing sensitive health data, especially personal health information (PHI). For organizations impacted by HIPAA, a managed file transfer solution offers numerous advantages: industrial-grade security, enhanced file tracking, high reliability and availability that is backed up by service level agreements, and cost savings as IT staff is freed up to focus on other operational tasks.
As on-premise data breaches and the growing scale of achieving and maintaining HIPAA compliance continue to raise the stakes, these benefits provide a compelling reason for organizations to move to a managed cloud environment.
A few best practices
If your organization is considering making the shift to a HIPAA compliant cloud solution, there are a few “best practices” to keep in mind.
- First, invest in partners that are well-equipped to manage the breadth of HIPAA standards, and who are able to provide the tools needed to demonstrate compliance to your auditors.
- Also, make sure to look for partners that provide a packaged HIPAA compliant environment that satisfies electronic protected health information (ePHI)-related legal obligations in HIPAA/HITECH legislation.
- Lastly, recognize from the start that your HIPAA compliance will usually involve a hybrid solution that combines both cloud and on-premise elements. A combination of cloud and on-premise will provide the enabling “fabric” that will make it possible to do business moving forward.
As the data explosion continues and more ePHI is exchanged between endpoints, there are increasing security risks – and a growing number of organizations that are required to maintain compliance with HIPAA, HITECH and HIPAA Omnibus Standards. By adhering to the best practices outlined above – and creating and deploying a cloud migration plan – organizations can realize the security and economic benefits, while improving their ability to achieve compliance.
About the Author: Ken is currently the Director of Product Marketing for Ipswitch File Transfer and is responsible for all product messaging, positioning and marketing content around the product portfolio. Prior to joining Ipswitch, Ken was the Director of Product Marketing at Metalogix, one of the largest Microsoft SharePoint ISVs. Ken holds a BA in mathematics / computer science from Hamilton College and an MBA in strategic marketing from the University of Southern California, Marshall School of Business.