The HIPAA Security Rule: Cloudy Skies Ahead? Presented and Prepared by John Kivus and Emily Moseley Wood Jackson PLLC
HIPAA and the Cloud In the past several years, the cloud has become an increasingly popular way for both individuals and companies to store and manage their data and IT needs. Dozens of cloud computer providers now populate the landscape, including Amazon, Box (formerly Box.net), Citrix, Dropbox, Google, Microsoft, and SpiderOak. Many individuals and companies, however, may have entered the cloud without fully understanding what precisely it is or, more accurately, the many things it may be. Recent modifications to the HIPAA Security Rule resulting from the Health Information Technology for Economic and Clinical Health Act ( HITECH ) mean that any entity relying on the cloud to host electronic protected health information ( ephi ), can no longer simply have its head in the clouds regarding whether their cloud computing arrangements meet the requirements of the HIPAA Security Rule. The Cloud The National Institute of Standards and Technology (NIST) broadly defines cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction. To be considered part of the cloud, the NIST requires the following essential characteristics: On-demand self-service: a consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider; 1
Broad network access: capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms; Resource pooling: the provider s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction; Rapid elasticity: capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time; and Measure service: cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service. Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service. Cloud providers can provide those essential characteristics through different types of offerings, including: Software as a Service (SaaS): the capability provided to the consumer is to use the provider s applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web 2
browser, or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited userspecific application configuration settings; Platform as a Service (PaaS): the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment; and Infrastructure as a Service (IaaS): the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components. Cloud providers deploy these offerings several different ways, including the following: Public Cloud: the cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the 3
cloud provider; Private Cloud: the cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers. It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises; Community Cloud: the cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns. It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises; Hybrid Cloud: the cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability. The HIPAA Security Rule Before examining the interplay of the HIPAA Security Rule and the cloud, it is helpful to take a step back and take a brief look at the HIPAA Security Rule, found at 45 CFR 164, and who must comply with it. Perhaps obviously, covered entities must comply with the HIPAA Security Rule. While business associates have long had to comply with the HIPAA Rules by virtue of their contractual obligations with covered entities, they are now obligated to do so as well by recent modifications to the HIPAA regulations. As explained below, this now means that cloud providers maintaining data on behalf of 4
covered entities (or a business associate) generally will be considered business associates and subject to the Security Rule. Health plans, clearing houses, and healthcare providers that transmit any health information in electronic form in connection with a transaction covered by HIPAA are deemed to be covered entities. Health plans provide or pay for the cost of medical care and include insurers, HMOs, Medicare, Medicaid, employee welfare benefit plans, and issuers of long-term care policies. Healthcare clearing houses either (a) process health information received from one entity in a nonstandard format (or containing nonstandard data) into standard elements transaction or (b) receive a standard transaction from another entity and then process the health information into nonstandard format or data from the receiving company. As a result, they include everything from billing services to community health information systems. Healthcare providers, as the term suggests, furnish, bill, or are paid for healthcare in the normal course of business. While this definition may seem clear, it broadly extends to preventative, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, as well as counseling, service, assessment, or procedures with respect to the physical or mental condition of an individual. Healthcare also includes the sale or dispensing of a drug, device, equipment, or other item pursuant to a prescription. Accordingly, doctors, clinics, psychologists, dentists, chiropractors, nursing homes, and pharmacies are all deemed healthcare providers but are subject to the HIPAA Security Rule only if they transmit any information in electronic form. 5
Business associates are those who create, receive, maintain, or transmit protected health information on behalf of a covered entity. Recent modifications to the HIPAA regulations expanded the definition of a business associate and made many of the provisions of the HIPAA Rules apply directly to business associates in the same manner as covered entities. Despite extending much of the Security Rule directly to business associates, covered entities must continue to have agreements in place with their business associates, providing satisfactory assurances that the business associate will safeguard any electronic protected health information and comply with the applicable parts of the Security Rule. Business associates must have similar contracts or arrangements in place with their own subcontractors that create, receive maintain, or transmit electronic protected health information and that are therefore business associates themselves. A wide range of activities that are closely integrated with the day-to-day operations of covered entities can render a company a business associate, such as claim processing, data analysis, utilization review, quality assurance, patient safety activities, billing, benefit management, practice management, and repricing. The regulatory definition of business associate, however, extends much further, to include those who provide legal, accounting, consulting, management, administrative, accreditation, or financial services to a covered entity. Health information organizations, e-prescribing gateways, organizations that facilitate data transmission, and vendors of personal health records (on behalf of covered entities) are deemed business associates under the modified HIPAA regulations. 6
As the Department of Health and Human Services explained when promulgating the modified HIPAA Rules, it will continue to recognize a narrow conduit exception for courier services, like the United States Postal Service, which transport information, but do not have access to it except on a very infrequent basis. The conduit exception, while narrow, extends to the electronic equivalent of the U.S. Postal Service, such as internet service providers, that provide only data transmission services. To fall within the exception, however, the data transmission service must only transmit the data and not have access to it, except on a random or infrequent basis. Temporary storage of transmitted data incident to the transmission will not remove a data transmission service from the conduit exception. A company that maintains electronic protected health information on behalf of a covered entity (or as a subcontractor of a business associate), however, cannot avail its of the conduit exception, even if it does not actually view the information. Electronic document and data storage companies maintaining electronic protected health information on behalf of covered entities will be considered business associates. As a result, cloud providers are considered business associates if they store or maintain electronic protected health information. This means that all levels of a given cloud technology stack (e.g., the provider that houses the data, the provider that houses the application that utilizes the ephi information, etc) could be, and likely are, considered business associates under the Security Rule. Consequently, it is increasingly important to understand not just who cloud providers are, but where and how the providers store and transmit the information. 7
Covered entities and business associates must comply with HIPAA s security standards for electronic protected health information. Both covered entities and business associates, must: (1) ensure the confidentiality, integrity, and availability of all electronic protected health information that it creates, receives, maintains, or transmits; (2) protect against any reasonably anticipated threats or hazards to the security or integrity of such information; (3) protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required; and (4) ensure compliance with this subpart by its workforce. It is questionable, however, whether any entity can ensure the confidentiality of electronically stored information or that every member of its workforce will comply with his or her confidentiality obligations. Moreover, while the Security Rule clearly articulates what covered entities and business associates must do to protect ephi, it does not provide much in the way of detail with regard to how they should do it. Causing additional room for uncertainty, HIPAA expressly authorizes a flexible approach to the Security Rule, permitting the use of any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementations (of the Security Rule). It is tempting, therefore, to simply outsource as much IT as possible, sending it to the cloud. While HIPAA may permit the off-sourcing of IT tasks or services, it does not permit the off-sourcing of responsibility for HIPAA compliance. The HIPAA Security Rule requires that all covered entities and business associates implement policies and procedures to prevent, detect, contain, and correct security violations. This, in turn, 8
requires an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. Any such assessment should now include an understanding of the risks of storing protected health information in the cloud generally and the specific security risks and safeguards of the chosen cloud provider. The risks associated with storing electronic protected health information in the cloud are not dissimilar from the risks associated with storing electronic protected health information locally. They include user error, system failure and susceptibility to outside intrusion. Putting the information in the cloud does not remove those risks, nor, in most cases, does it increase those risks. Instead, cloud based electronic protected health information requires different analysis when evaluating the risks. As a general rule, in order to help protect electronic protected health information it is important to (i) properly configure networks, particularly wireless ones; (ii) properly implement encryption of data; (iii) assign appropriate user access roles; and (iv) develop an appropriate bring your own devices (BYOD) policy. Other steps, however, may also be needed to comply with the requirements of the HIPAA Security Rule. Therefore, the relationship as outlined by the contracts between the various cloud providers and the organization must be carefully examined and understood. This means knowing a number of things about the entire cloud technology stack, including, but not limited to, (i) at what cloud provider is the electronic protected health information actually stored, (ii) how is that provider encrypting and/or otherwise restricting access to that electronic protected health information, and (iii) how is the electronic protected health information being transmitted 9
between providers and end uses and what types of access control, encryption and other security are being applied during that transmission. Covered entities and business associates must allow only authorized individuals access to electronic protected health information and must implement procedures to verify that a person or entity seeking access to ephi is the one claimed. Required measures include unique user names or numbers to identify and track user identity. Relatedly, user passwords should meet requirements with respect to (i) length, (ii) complexity, (iii) variation, and (iv) variety. Microsoft publishes its current recommendations with respect to those requirements (see, http://www.microsoft.com/security/online-privacy/passwords-create.aspx) and also provides at password strength checker to test potential passwords (see, https://www.microsoft.com/security/pc-security/password-checker.aspx.) When a formerly authorized individual leaves an organization (or is transitioned to a role where her or she no longer requires access to ephi), his or her user account should be updated so that it no longer allows access to ephi. When using platform and infrastructure cloud providers, it is important to remember that traditional access rule standards still apply. In other words, it is important to consider who within your organization should have access to the "close to the metal" services such as the filesystem, the database, and user management and understand how will these peoples activities be tracked. Relatedly, it is important to understand which provider in the technology stack will be responsible for monitoring the stack for vulnerabilities and/or intrusions, as well as keeping each level of the stack up to date (e.g., will the cloud 10
provider be responsible for providing updates to the underlying operating system or will that be something that will require a separate IT consultant?) The Security Rule requires that covered entities and business associates establish and implement as needed contingency plans in the event of an emergency, disaster, or other event that damages systems that contain electronic protected health information. Any such plan must include data backup, disaster recovery, and emergency mode operation (for the protection of the security of ephi while operating in disaster mode). Covered entities and business associates must also ensure that electronic protected health information is not altered, modified, or destroyed. Having data stored with a cloud provider may mean that an organization does not need to have as robust system of local backups both on and off site, but it does not mean that the principles of good backups no longer apply. Instead, the organization must understand how the cloud provider backs up information (including frequency, redundancy, and verification), and how easy it is for the organization to access those backups when necessary. Furthermore, an organization must understand how a cloud provider's policies with regard to data access and backups could be impacted by natural disasters and other unforeseeable events. The Security Rule requires a regular review of records of information system activity, such as audit logs, access reports, and security incident tracking reports. Suspected or known security incidents must be identified, responded to, and, if possible, mitigated. It is important for organizations to understand who is responsible for monitoring the safety of their data in the cloud, when and how cloud providers will notify 11
it about potential security related incidents (e.g. will the cloud providers provide a control panel that displays information but that must be checked on a regular basis? Will the cloud providers send out updates in the event of a possible attack or breach? Will the cloud provider temporarily suspend service if it detects a breach attempt, in order to prevent a successful breach from occurring?) Although not mandated by the HIPAA Security Rule, entities hosting electronic protected health information in the cloud are well advised to encrypt their data. Recent Resolution Agreements between HHS and covered entities or business associates amply demonstrate the risk of loss or theft of unencrypted data. While such an event may be less likely to occur when data is housed in the cloud, as opposed to a hard drive or computer that can be lost or stolen, the failure to apply the full range of practical and available technological safeguards to electronic health information, may be viewed by regulators as part of a larger failure to assess risk, implement controls, and create a culture of compliance. The Security Rule, however, provides only a very general definition of encryption, as the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key (45 CFR 164.302). Given this high level definition it can be difficult to determine if the electronic protected health information with which covered entities and business associates have been entrusted should be encrypted or is adequately encrypted. As with most aspects of the relationship between the cloud provider and the organization, it is important to carefully review contracts and service level agreements associated with all 12
levels of an organization s cloud provider stack to help determine where encryption should be implemented along the stack. The NIST provides its Advanced Encryption Standard ( AES ), with up to a 256-bit key, as a standard for how important data should be encrypted. Cloud computing provides a number of advantages and opportunities when compared to locally hosted servers. These include the ability to rapidly grow an organization s capacity without large upfront investment, to provide access to data across a variety of different platforms and from different locations, and to outsource some of the more difficult server maintenance tasks to providers who might have more experience and resources to deal with new and existing problems and threats. These benefits, however, do not come without some trade-offs, including a lack of direct control of how data is stored and protected. In the cloud is not a satisfactory answer for where and how electronic protected health information is being stored, transmitted, and used. Instead, an organization must understand its full cloud provider stack, from where the data is actually being stored through where it is displayed to authorized end users. This knowledge is different than what is necessary to repel outside network intrusions, but it is just as important when it comes to making sure an organization compiles with the various regulations that make up HIPAA s Security rule. Security Rule Audits After a brief hiatus, HHS s Office of Civil Rights is resuming HIPAA audits for fiscal year 2014. While the initial pilot phase of the audit program focused on covered entities, it appears that business associates will be covered in the next round. A recent 13
OIG report analyzing whether OCR met federal requirements for oversight and enforcement of the Security Rule concluded that OCR had failed to adequately assess whether audited entities had complied with the Security Rule and that OCR itself had not fully complied with cybersecurity requirements. While recognizing limitations in OCR s resources and their allocation to managing an increasing number of Security Rule investigations triggered by press reports and individual complaints, the OIG recommended that OCR perform the compliance audits mandated by HITECH to ensure Security Rule compliance. It appears likely, therefore, when these audits do begin, there will be an increased emphasis of Security Rule compliance, making it all the more important that covered entities and business associates remain mindful of meeting its requirements and keeping their heads, if not their data, out of the clouds. 14