What Is HIPAA? The healthcare industry is rapidly moving towards increasing use of electronic information systems - including public and private cloud services - to provide electronic protected health information (ephi) and conduct a host of other administrative and clinically based functions. Along with the rise in the adoption rate of these new technologies comes along the rise in potential security risks to the patient s medical records and other health care information. Note: ephi is the electronic form of Protected Health Information (PHI) encompassing demographic data such as name, address, birth date, Social Security Number that relate to: The individual s past, present, or future physical or mental health or condition The provision of health care to the individual The past, present, or future payment for the provision of health care to the individual To mitigate the risks of security breaches and unauthorized use or disclosure on these sensitive data while stored, processed and exchanged between health care organizations and parties the HIPAA - Health Insurance Portability and Accountability - Act published two specific regulations: The HIPAA Privacy rule and the HIPAA Security rule. The Privacy rule imposes controls around preventing unauthorized disclosure of Protected Health Information (PHI) in any form. It requires appropriate safeguards to protect the privacy of PHI and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization. The rule is all about authorized disclosure. 1
The Security Rule covers the protection of the confidentiality, integrity and availability of electronic protected health information (ephi). It prescribes a number of required policies, procedures and reporting mechanisms that must be in place for all information systems that process, store and transmit ephi within and between covered entities. What is the HITECH Act? The HITECH - Health Information Technology for Economic and Clinical Health Act provides substantial incentives for hospitals and physicians to adopt electronic health records (EHRs) and provides grants for the development of health information exchange (HIE). In the context of HIPAA, the HITECH Act: Substantially expands application of the HIPAA privacy and security requirements directly to business associates (See Who should care) Increases criminal and civil penalties for violations of HIPAA. Makes HIPAA s criminal and civil penalties applicable to business associates. Creates a new federal security breach reporting requirement for HIPAA covered entities and their business associates. Expands application to Business Associates Increases Criminal & Civil Penalties Penalties Applicable to Business Associates Create New Federal Security Breach Key Challenges According to Gartner, there is no general agreement on what constitutes sufficient HIPAA security compliance and protection when using alternative delivery models, such as SaaS and cloud. More specifically, the rules for HIPAA/HITECH compliance do not explicitly address placing ephi into cloud services. Organizations that find it necessary to place ephi in the cloud must exercise a thorough diligence process, make defensible decisions and, above all, accept a certain amount of risk. 2
There are no magic solutions, providers or controls in that case. Therefore, organizations are advised to only put business processes that involve ephi in third- party data centers (cloud, SaaS, etc.) where they can provide a defensible level of assurance that it will be protected with reasonable and appropriate controls against reasonably anticipated risks. Who Should Care Any healthcare organization that stores, processes or transmits (e)phi records is considered a covered entity and is required to adhere to the privacy and security rules of the HIPAA law. More specifically: Health care providers -Hospitals, clinics, regional health services, individual medical practitioners Health care clearinghouses - Entities that help health care providers and health plans standardize their information Health plans - Insurers, HMOs, Medicaid, Medicare prescription drug card sponsors, flexible spending accounts, public health authority, in addition to employers, schools or universities that collect, store or transmit PHI information to enroll employees or students in health plans With HITECH, application of the HIPAA rules is expanded to business associates and their subcontractors. A business associate creates, receives, maintains, or transmits protected health information on behalf of covered entities (e.g. Cloud service provider). A subcontractor does the same but on behalf of the business associate. Guidance on how to determine whether an entity is a covered entity is available on the Centers for Medicare & Medicaid Services website. Why Comply? Covered entities that fail to comply voluntarily with the standards may be subject to civil money penalties. There are four tiers of increasing penalty amounts that correspond to the levels of culpability associated with a HIPAA violation. The minimum fines range between$100 and $50,000 per violation, and are capped at $1.5 million for all violations of the same HIPAA provision during any calendar year. 3
HIPAA Violation Penalty Tiers 01 02 03 04 $100 - $50,000 per Incident up to $1.5 Million The Covered Entity did not know and could not resonalbly have known of the breach $1000 - $50,000 per Incident up to $1.5 Million The Covered Entity knew or beyond exercising reasonable diligence would have known of the violation though they did not act with wilful neglect $10,000 - $50,000 per Incident up to $1.5 Million The Covered Entity acted with willful neglect and corrected the problem within a 30day time period $50,000 per Incident up to $1.5 Million The Covered Entity acted with willful neglect and failed to make a timely correction Complying with HIPAA Security Rules 01 02 03 04 The lowest category of violation covers situations where the covered entity or business associate did not know, and by exercising reasonable diligence would not have known, of the HIPAA violation. The second lowest category of violation applies to violations due to reasonable cause and not to willful neglect. Reasonable cause means here an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated HIPAA, but in which the covered entity or business associate did not act with willful neglect. By willful neglect one means the conscious, intentional failure or reckless indifference to the obligation to comply with HIPAA. The third category applies to situations where the violation was due to willful neglect and was corrected within 30 days of when the covered entity or business associate knew, or should have known, of the violation. The fourth category applies to situations where the violation was due to willful neglect and not corrected within 30 days of when the covered entity or business associate knew, or should have known, of the violation. 4
HIPAA Audit Protocol The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for administering, enforcing and validating the standards and may conduct complaint investigations and compliance reviews. All covered entities may be subjected to audit. OCR selects the entities to audit. Complying with HIPAA Security Rules Cloud services provider levels of transparency about controls used for HIPAA/HITECH requirements are incredibly varied and can cause significant confusion when comparing vendors against compliance needs. That being said, HIPAA security rule compliance requires organizations to do a risk assessment against defined areas and implement reasonable and appropriate controls against reasonably anticipated risks. Defensibility is a key concept to success with HIPAA security rule compliance. The security rule lists a set of security requirements (standards) for the protection of the ephi records. Administrative Safeguard Security management process (section 164.308.a.1) Assigned security responsibility (section 164.308.a.2) Workforce security (section 164.308.3) Information access management (section 164.308.a.4) Security Awareness Training (section 164.308.a.5) Security incident procedures (section 164.308.a.6) Contingency plan (section 164.308.a.7) Evaluation (section 164.308.a.8) Business associate contracts and other arrangements (section 164.308.b.1) 5
Physical Safeguard Facility access controls (section 164.310.a.1) Workstation use (section 164.310.a.2) Workstation security (section 164.310.a.3) Device and media controls (section 164.310.a.4) Technical Safeguard Access control (section 164.312.a.1) Audit controls (section 164.312.a.2) Integrity (section 164.312.a.3) Person or entity authentication (section 164.312.a.4) Transmission security (section 164.312.a.5) Organizational requirements Business associate contracts or other arrangements (section 164.314.a.1) Requirements for group health plans (section 164.314.a.2) Policies, procedures and documentation requirements Policies and procedures (section 164.316.a.1) Documentation (section 164.316.a.1) Covered entities must decide whether a given security measure is reasonable and appropriate to apply within its particular security framework. How individual security requirements would be satisfied and which technology to use are both business decisions. These decisions will depend on a variety of factors, such as, among others: the entity s risk analysis, risk mitigation strategy, what security measures are already in place, and the cost of implementation. Based upon this decision the following applies: Reasonable and appropriate security measures must implemented. Inappropriate and/ or unreasonable security measures could be replaced by alternate ones that accomplish the same end as the addressable implementation specification. 6
The decision not to implement the addressable implementation specification, the rationale behind that decision, and the alternative safeguard implemented to meet the standard must be documented. A Note on Breach Notification HHS issued regulations requiring health care providers, health plans, and other entities covered by the HIPAA to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals. Breaches affecting fewer than 500 individuals will be reported to the HHS Secretary on an annual basis. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate. A breach notification is not required if a covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised. 7
CloudLock Security Fabric Supports Your HIPAA Compliance in the Cloud Meeting internal or external compliance regulations can be a tremendous challenge for any IT organization using software as a service (SaaS) applications. CloudLock provides the visibility and control you need to quickly detect and respond to risks of data that is sensitive, toxic, and/or subject to HIPAA regulation, while confidently working in the cloud. CloudLock s cloud security solution helps covered entities, business associates and subcontractors achieving HIPAA compliance through both administrative and technical safeguards. Administrative Safeguard Information access management Identify and monitor in real-time financial ephi data within your cloud apps. Additional sensitive data monitored includes SSNs as well as admin-specified keywords and regex structured to find terms and combinations of interest. Security Awareness Notify and educate users to encrypt sensitive information based on policy violations of over-shared or inappropriately stored data. Identify and surface users who repeatedly trigger security incidents, leading to outreach or more drastic mitigation measures. Incident Response Centrally manage all incidents based on unified policies. Investigate flagged content and potentially toxic data in files and documents. 8
Easily view and filter incidents based on severity level, object type, cloud app, status, date and other criteria. Prioritize and track incidents based on business impact to your organization. Create incident reports. Automate response actions and notifications to your end users with CloudLock s fully automated remediation management capabilities. Integrate CloudLock s incident management service with your own enterprise systems, e.g. IT support and SIEM solutions. Technical Safeguard Access control Enforce proper access controls for all relevant apps and ephi records in the cloud. Provide ongoing verification and control of access rights. Protect your organization from malicious data extraction. Monitor access to your cloud apps and associated data. Control and track addition, deletion and modification of users. Track inactive accounts. Enforce strong encryption of documents containing ephi records. Leverage industry best encryption and key management technology, using AES-256 password-based encryption. Empower your end-users to selectively encrypt sensitive information as a service and securely share the encryption keys with authorized parties. Monitoring, and Analysis of Audit Logs Monitor user activity to detect potential anomalies and significant changes. Create alerts and incidents based on suspicious logins. Track user access of privileged user changes and change permission history. Use audited data as evidence of compliance to regulations and internal policies. 9
Feed time-sensitive and critical security events into your company-wide SIEM solutions for a consolidated security view. Gain real-time insight into the health of your public cloud applications in one unified dashboard. Leverage out-of-the box security and compliance reports to meet regulatory requirements with internal and external auditors. Integrity Determine if central cloud app configuration settings meet predefined golden standards. View what changes are made to cloud app settings Alert security and administrative staff whenever configuration changes violate security policies. 10
The Cloud Security Fabric CloudLock offers the cloud security fabric enabling enterprises to protect their data in the cloud, reduce risk, achieve compliance, manage threats, and increase productivity. Learn More By analyzing 750 million files for more than 6 million end users daily. CloudLock delivers the only complete, risk-appropriate, and people-centric approach to cloud security. www.cloudlock.com info@cloudlock.com (781) 996-4332