Healthcare organizations are embracing the many advantages of cloud computing, including its scalability, cost-efficiency, and flexibility. While the cloud makes file storage and sharing easy and convenient, its security risks are numerous enough to have given rise to the CASB category. Before implementing a solution, however, it’s important to understand how industry regulations impact cloud adoption – and what to look for when selecting a cloud-storage service provider.
If your business must be HIPAA compliant, these 10 questions to ensure HIPAA compliance might save you some major headaches down the road.
- Does your cloud provider have the right policies in place?
A cloud services provider must have a program that meets specific security policies and procedures as mandated by HIPAA. One such policy is a Business Associate Agreement (BAA) that sets forth a specific set of guidelines for HIPAA compliance for all parties, including sub-contractors, involved with storing data. With a BAA, cloud providers and all associated parties are liable in the event of data loss or theft. Make sure all the companies handling your data sign a BAA.
- Do they have a dedicated staff for HIPAA compliance?
Your cloud services provider should have dedicated employees on-site working to ensure HIPAA regulations are met. This way, you can have peace of mind knowing that your cloud services provider works around the clock to monitor compliance and delivers a consistently high level of security.
- What is the encryption process for data?
Your provider must guarantee that the transfer of data to and from the cloud is encrypted and secure. HIPAA dictates that FIPS-140-2 encryption is in place for any ePHI (electronic protected health information) that is in transit. There should also be an encryption for data that is at rest in SANs (storage area networks), on local drivers, and for backups on hard drives.
- Do they have access controls?
Preventing hackers doesn’t just involve encryption. Measures must also be in place to prevent any internal breaches. Master keys and electronic IDs are two ways in which the provider could safeguard security and limit data access. Biometric scans, such as fingerprint or eye scans, are becoming increasingly popular with tech firms, and that’s a good thing for clients.
- Do they offer offsite backups?
HIPAA also requires that secure offsite backups are in place. This is key to keeping data safe in the event of something catastrophic that could lead to loss or theft.
- What security awareness training processes do they have in place?
Cloud providers need to consistently assess procedures to make sure they are operating within HIPAA regulations. Providers need a structured and up-to-date program to ensure their employees and clients are familiar with all potential security issues. These programs will also need to be updated as HIPAA regulations change. Human error is one of the main sources of security breaches, so it’s important that the vendor you select understands the importance of ongoing training.
- What additional credentials or certifications do they have?
HIPAA compliance is never guaranteed, however, having other qualifications can go a long way to help clients feel secure. Good questions to ask your prospective cloud service provider should include whether they have additional certifications such as:
– SOX compliance
– PCI DSS compliance
– SSAE-16
– SAS70 type II
- How do they meet data encryption standards?
As mentioned before, providers need to encrypt any data in transit to and from the cloud to make it secure. This also means keeping up with the latest encryption standards and not falling behind industry best practices. Security and encryption are likely at the very top of your list of concerns, so be sure to make this question an important part of the conversation.
- Do they have a disaster recovery plan?
Whether it’s a natural disaster or man-made, any managed service provider must have a plan in place to deal with data recovery in order to stay compliant. This should be well documented and their staff should have immediate access so proper processes and procedures can be put into action immediately. Ask for a copy of a vendor’s disaster recovery plan as part of your evaluation process.
- Do they maintain regular internal audits?
HIPAA looks closely at whether or not you are performing regular audits on your own vulnerabilities, although the definition of ‘regular’ is not spelled out. Both monthly and quarterly internal reviews are recommended, as well as periodic and annual third-party assessments. As part of your evaluation processes, ask about your prospective vendor partners’ internal audit schedule. Once you’ve selected a cloud services vendor, ask to be notified whenever an internal audit is performed. If that doesn’t happen at least every quarter, consider asking for that. cloud disaster recovery services
Leave a Reply