Privacy and Security Issues in Cloud Computing in Health Care

Learn more on the security issues that can arise within computing systems in health care.

Many covered entities and business associates who are required to comply with HIPAA as well as other federal and state law requirements protecting the privacy and security of patients' identifiable data still misunderstand the impact of cloud computing on their electronic protected health information (ePHI), as well as the organization's overall HIPAA compliance. There also continues to be misunderstanding of whether a vendor which transmits and/or hosts an organization's ePHI is a HIPAA Business Associate, or not. This topic helps the persons responsible for their organization's compliance with HIPAA and other federal and state laws ensure that ePHI which is hosted, maintained and/or transmitted by a Cloud Vendor is secure and not used and disclosed in an unauthorized manner. The topic also explains the most critical requirements of the HIPAA Security Rule that an organization should focus on when evaluating a Cloud Vendor. This material will go into detail and provide you and your organization with a roadmap for evaluating your Cloud Vendors, and ensuring that your contract adequately protects your organization and its ePHI before it is 'handed off' to a Cloud Vendor. This information is critical for organizations to hone their Security and Privacy policies and procedures to prevent Breaches and address any shortcomings in their HIPAA compliance program attributed to the use of a Cloud Vendor. HHS/OCR investigation and recent Attorney General settlements have stated that the Covered Entity is the initial gate-keepers to ePHI which must evaluate all vendors, including those utilizing The Cloud, with due diligence.

Faculty

Helen Oscislawski, Esq.

Attorneys at Oscislawski LLC