Sponsored by: Atlantic.Net, Inc.
HIPAA-Compliance is an important but complicated world. It’s somewhere that every healthcare worker in the U.S. needs to take the time to visit to become fully aware of the legislative implications on their work-life.
Healthcare is becoming more embedded in digital every year. Since digital health records and protected health information (PHI) need to be transferred, updated, and securely shared, it is paramount to have HIPAA-Compliance at the forefront of decision making regarding IT hosting.
Many healthcare practices choose to outsource this responsibility to a HIPAA Compliant hosting provider. This organization has a moral and legal obligation to uphold the data integrity of patient information to the required physical, technical and administrative safeguards of HIPAA.
Here are five considerations when choosing your next HIPAA Compliant hosting provider.
- Get A Business Associate Agreement
The BAA offers fundamental protection and a mandatory requirement of HIPAA legislation that should be openly encouraged by the hosting provider. The BAA lays out how health information is used and transmitted between the healthcare provider, the hosting provider, and any business associates used by either party.The BAA is a combination of guarantees given to the Healthcare organization. It defines expectations and service level agreements and documents the response times for incidents and the expectations for disaster recovery. It outlines the permitted uses and disclosures of PHI and clearly defines the Covered Entity’s responsibilities. - Can the Hosting Partner Provide Suitable Business Continuity?
The best HIPAA hosting providers own and manage their private infrastructure. HIPAA legislation demands that PHI data must be protected at all times, and access to PHI must always be available. To achieve this goal, the hosting provider needs a robust, tried, and tested backup solution for data protection. This is achieved using daily backups, the data must be replicated to an alternative location to be compliant. This approach is called a 3-2-1 backup strategy, one live copy of production data, one local backup, and one offsite backup.The hosting provider must also have the ability to run critical IT systems at an alternative location in the event of a major incident or unexpected downtime. For IT systems that serve PHI data, an automated disaster recovery solution can create a replica server in an alternative location, keeping the system available at all times. - Is All Data Encrypted?
One of the most important HIPAA rules regards the encryption of data and networking. Choose a HIPAA hosting platform that encrypts all data as standard to a minimum benchmark of AES-256bit. Static data encryption is important, and it protects the integrity of the data in case any hardware is lost or stolen. Systems that contain PHI should be encrypted, be that a database or a file server.The network layer must also be protected when PHI data is flowing across the network. It’s important to use encrypted channels over a VPN so that any data leaving the secured network perimeter is protected by default. - Server Management
One of the cornerstone requirements of HIPAA-Compliance is having a Web Application Firewall (WAF) to defend against the very latest cybersecurity threats. Its purpose is to protect and enhance the security of individual website applications. The WAF protects the application front end to ensure that the traffic passing between the stack and the internet is legitimate and highly secure.A WAF is typically available as a managed service from the HIPAA cloud hosting provider, other important server management options include MFA (Multi-Factor Authentication), Auto server patching, and end-user security tools such as Anti-Virus deep security. IPS (Intrusion Protection System) works hand-in-hand with the WAF to provide packet layer inspection of traffic to detect threats and anomalies. - Can The HIPAA Hosting Provider Evidence A Highly Secure Datacenter?
Eliminating risk is a key part of HIPAA compliance, and the cloud hosting provider must be audited to ensure a compliant hosting environment. The physical data center must comply with exacting standards regarding security and internal processes. The cloud hosting provider’s infrastructure must be secured and highly redundant (fail-safe) and have features such as enhanced cooling and backup generators.Certifications are the best way to determine the provider’s HIPAA credentials. Look for the HIPAA Audited certification. This validates the provider hosting solutions, support teams, and business processes are fully compliant with HIPAA standards. The HITECH takes compliance to the next level with standards for privacy and security of confidential Electronic Health Record (EHR) data. Other standards like AICPA SOC and ISO further boost the provider’s credentials.Choosing the best HIPAA cloud hosting provider is an important decision and one that takes careful consideration. These five considerations should form part of a wider scope of benefits offered by the Host.