What’s HIPAA?
Healthcare organizations process a wealth of sensitive and private data that comes under government regulation. The Health Insurance Portability and Accountability Act (HIPAA) is the central healthcare regulation in the United States. HIPAA has strict rules around how protected patient health information is processed and stored. To be compliant, healthcare organizations must meet these rules.
In theory, protecting healthcare data should be straightforward – but the history books show us that it’s something companies struggle with today. There’s been more than 186,000 privacy rules compliance since 2003, according to HHS.Gov. It’s clear that, while there are strict rules in place for patient data, following them isn’t so easy.
One of the main reasons for this is the proliferation of cloud computing and SaaS applications. With the pandemic, healthcare organizations accelerated their adoption of tools for telemedicine and remote collaboration. In line with this, a key challenge for healthcare organizations today is ensuring that medical data is stored, processed and transferred compliantly when employees and patients are communicating across digital channels.
What’s a covered entity?
In HIPAA, covered entities are healthcare providers and organizations that process electronic patient data. Doctors, pharmacies, healthcare insurance companies, healthcare clearinghouses, and health maintenance organizations are all considered covered entities.
By law, covered entities must comply with HIPAA – and there are steep consequences if they fail to do so. When it comes to patient data, there are strict security rules, which organizations must demonstrate compliance with through various controls.
The HIPAA Security Rule
The HIPAA Security Rule contains the standards that govern how patient data should be created, accessed, processed and stored. There are three safeguards that must be put in place:
Administrative: Focuses on the policies and procedures that safeguard against a data breach, including documentation process, roles and responsibilities, training and data practices.
Physical: Ensures that data is physically secure using measures such as CCTV, secure computer locations and manual measures like locked doors and windows.
Technical: Focuses on the technology solutions that prevent data from being maliciously or improperly accessed. Standard solutions for this include encryption, data loss prevention and multi-factor authentication.
What does HIPAA say about SaaS Workflows
Covered entities are allowed to use cloud service and SaaS providers for processing, transacting and storing PHI. However, employees must use these services in a compliant manner. It is incumbent on the covered entity to ensure that its employees are trained and to monitor for breaches.
Privacy Rule: The CSP must ensure it only stores and discloses PHI as allowed by the HIPAA Privacy Rule.
Security Rule: PHI must be correctly protected from a data breach – both when data is at rest or in transit.
The Breach Notification Rule: If there is a breach, this must be reported to the HHS.
You’ll want to conduct a risk assessment to ensure that your provider has adequate processes and safeguards in place to protect your PHI. In turn, they may conduct a risk analysis on your organization before starting the arrangement.
What about SaaS Applications and HIPAA?
Many healthcare organizations have embraced apps like Teams, Zoom and Slack to get work done at a distance.
Under HIPAA, it is your responsibility to make sure that these applications comply before and during use for storing or transferring patient health data.
So, before using a SaaS application, be sure to check your vendor and the controls they offer – and perform a risk assessment.
HIPAA compliance in Slack – and applications like it – relies on proper configuration and usage. Employees must be trained and monitored to prevent leaks.
Common challenges of securing PHI in SaaS applications
Gartner’s cloud security report states that, by 2025, 99% of cloud security failures will be the customer’s fault. The big guys like Slack, Google, and Microsoft are responsible for protecting their infrastructure from data breaches. Still, it’s up to you to ensure the correct usage including configurations, policies and access controls.
The human factor
Humans require training and can still make mistakes. It is best to have training and enforcement. If an employee sends PHI to the wrong person, accidentally leaks a sensitive file or uploads it to a public Google Drive, your company is at risk of a substantial compliance fine.
More importantly, employees must use SaaS tools in a complaint manner to prevent leaking patient data. Patient data must be protected at all costs it is some persons info and they have trusted you with it.
What’s a healthcare organization to do?
While the stakes are high, healthcare organizations need to innovate to stay competitive. Cloud infrastructure and SaaS tools are the future. In order to use them – without breaching HIPAA compliance – healthcare organizations must think strategically and look beyond just encryption.
Organizations need a real-time, intelligent solution to keep PHI data safe no matter where it travels. This is where SaaS DLP comes in.
With the right solution, you can share sensitive information and remain HIPAA compliant at the same time.
Polymer’s data governance and DLP solution for 3rd party SaaS apps allows you to keep the patient’s data secure while meeting HIPAA compliance standards even if you’re a non-covered identity. The Virtual Compliance Officer works to help keep teams secure, whether in the office or working remotely, by monitoring SaS channels to prevent and mitigate sensitive data vulnerabilities.
The solution installs in a few clicks and is customizable as per your organization’s requirements.
