Seek Privacy, Security and Auditing Capabilities in Your Service Provider

By Jim Kane, Director, CIO Services

In this second post on preparing your healthcare organization for cloud computing, I will address how healthcare businesses subject to HIPAA should carefully select a service provider with the capabilities to address HIPAA Privacy, Security, and Audit as well as provide secure, scalable, low cost IT infrastructure.

HIPAA’s Privacy Rule requires that individuals’ health information are properly protected by covered entities, meaning that patients’ “protected health information” (PHI) cannot be transmitted over open networks or downloaded to public or remote computers without encryption. Encrypting data in the cloud include standards for the encryption of all PHI in transmission (“in-flight”) and in storage (“at-rest”). The same data encryption mechanisms used in a traditional computing environment, such as a local server or a managed hosting server, can also be used in a virtual cloud computing environment as well as a complete firewall solution.

The Security Rule requires covered entities to put in place detailed administrative, physical and technical safeguards - such as access controls, data encryption, and back-up and audit controls - to protect electronic PHI. While data flowing to and from the cloud should be safeguarded with encryption, data that comes in contact with administrators or third-party partners may require different control mechanisms. To help you comply with HIPAA’s Security Rule, policies and processes regarding data and how to implement authentication, access, and audit controls must be in place to reduce the risk of a compromise from outside. HIPAA’s security safeguards also require:

1. In-depth auditing capabilities,
2. Data back-up procedures, and
3. Disaster recovery mechanisms.

Service providers must be able to address these requirements. In designing a HIPAA-compliant system, you should put auditing capabilities in place to allow security analysts to drill down into detailed activity logs or reports to see who had access, what data was accessed, etc… This data should be tracked, logged, and stored in a central location for extended periods of time in case of an audit.

A major goal of HIPAA is to assure patients that their health information is properly protected while allowing the flow of information needed to provide and promote high quality healthcare for the public's health and well being. The development of a business-focused cloud computing strategy, internal corporate data policies and an accompanying transformation roadmap can lead to the successful implementation of HIPAA applications and infrastructure in the cloud computing environment.

Technorati Tags: TPI,cloud computing,HIPAA,service providers

Comments

[Vijaya Kumar Bhuttar]

Managing PHI is going to become increasingly complex as healthcare IT initiatives get implemented. Significant number of healthcare providers are going to adopt EMR’s by 2014, as part of the healthcare reform – although we can expect that a larger percentage of the new adopters will keep the patient data in datacenters managed by professional service providers, a significant percentage of the data may end up in local EMR databases within physician practices and clinics. Standardization of electronic transactions, EHR’s and health exchanges will make data more portable and available at different points of service. As a result, the volume of data being exchanged will increase significantly.

Both from a scalability, availability and security standpoint, private clouds would seem an ideal choice to store patient data. Managing the data centrally will also make logging and auditing consistent across healthcare entities.

[Megan]

Agree with you Vijaya :) I liked your input for this post. Every Cloud computing or Online Services should be scalable and measurable.