OCR Offers Guidance on HIPAA and Cloud Computing | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

OCR Offers Guidance on HIPAA and Cloud Computing

October 7, 2016
by David Raths
| Reprints
Cloud service provider that stores only encrypted data is still a business associate

The Health & Human Services Office of Civil Rights (OCR) has provided guidance around several questions regarding cloud service providers and HIPAA. For instance, if a cloud provider stores only encrypted protected health information and does not have a decryption key, OCR said it is still considered a HIPAA business associate.

OCR refers to cloud service providers (CSPs) storing encrypted PHI as “no-view” services. “As a business associate, a cloud service provider providing no-view services is not exempt from any otherwise applicable requirements of the HIPAA Rules,” OCR said.  “However, the requirements of the Rules are flexible and scalable to take into account the no-view nature of the services provided by the CSP.”

Regarding the HIPAA Security Rule, even when the parties have agreed that the customer is responsible for authenticating access to ePHI, the CSP may still be required to implement appropriate internal controls to assure only authorized access to the administrative tools that manage the resources (e.g., storage, memory, network interfaces, CPUs) critical to the operation of its information systems.  For example, a CSP that is a business associate needs to consider and address, as part of its risk analysis and risk management process, the risks of a malicious actor having unauthorized access to its system’s administrative tools, which could impact system operations and impact the confidentiality, integrity and availability of the customer’s ePHI. 

An exception that would see a provider as only a “conduit” of information is limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission.  Any access to PHI by a conduit is only transient in nature.  In contrast, a CSP that maintains ePHI for the purpose of storing it will qualify as a business associate, and not a conduit, even if the CSP does not actually view the information, because the entity has more persistent access to the ePHI.

OCR clarified that a CSP is not a business associate if it receives and maintains only information that has been de-identified following the processes required by the Privacy Rule. OCR also noted that if a covered entity (or business associate) uses a CSP to maintain electronic PHI without entering into a business associate agreement, the covered entity (or business associate) is in violation of the HIPAA rules. 

In a statement released by ACT, the App Association, its executive director, Morgan Reed, said that companies that fall under the newly created term, “no-view service provider” will face compliance questions around access which must be resolved. “Of course, further outstanding HIPAA questions remain as well. For example, there is still a lack of clarity around texting and messaging, which are central to patients’ and physicians’ lives. We look forward to working with OCR on these important issues.”

 

 

Get the latest information on Cloud Computing and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More

Topics

News

WellStar Health System Partners with PatientPing for Care Coordination Technology

Marietta, Ga.-based WellStar Health System, the largest health system in Georgia is partnering with PatientPing, a Boston-based health technology company, to use its care coordination technology across the health system.

Senators Introduce Bill to Expand Rural Telehealth Services

U.S. Senators Roger Wicker (R-Miss.) and Brian Schatz (D-Hawaii) have introduced bipartisan legislation to expand access to rural telehealth services. The bill would allow non-rural hospitals serving rural areas to qualify for support from the Federal Communications Commission (FCC) Healthcare Connect Fund (HCF).

Healthcare Company CoPilot Settles Data Breach with $130K Payment

CoPilot Provider Support Services, a New York-based corporation that provides support services to the healthcare industry, has agreed to pay $130,000 in penalties as part of a settlement to resolve a 2015 data breach that that exposed 221,178 patient records.

Senate Republicans Release Draft of Health Care Bill

On Thursday, Senate Republican leaders, who have promised to repeal former President Barack Obama’s healthcare legislation for seven years, moved forward on that goal with the release of a draft of their plan to repeal and replace the Affordable Care Act, which they expect to vote on next week.

Vermont HIE Implements IT Solution for Improved Data Quality

Vermont Information Technology Leaders (VITL), the operator of the Vermont Health Information Exchange, has announced the implementation of a data managing and synthesizing platform in an effort to expand its IT capabilities.

Survey: 75 Percent of CIOs Concerned About Incomplete, Inaccurate Medication Data

Despite multidisciplinary efforts to improve medication reconciliation, hospital CIOs still report unsatisfactory results, with three out of four concerned that their organization’s medication history data is incomplete or inaccurate, according to a new survey conducted by the CHIME Foundation.