Tag Archives: Health Insurance Portability and Accountability Act (HIPAA)

Cloud Computing Compliance and Industry Standards

October 12, 2015 Kris Price

Though cloud computing is known as a trendy technology, it is not in any way new in the computer networking field. The truth is that telecommunication companies were the first cloud service providers and they established some expectations for customers as well as industry standards for the past decades. Fast forward to 2015, the expectations remain unchanged; the standards of the cloud computing industry has been similarly modelled as in the Telcos, with some additions that are triggered by nature of operations and the transaction types that occur in the new cloud applications.

Definition of standard may be linked to the type of cloud computing in use. The cloud may be public, hybrid or private clouds. Also, the mandate around the private clouds requires loyalty to defined process and well established control frameworks. Documentation, backup controls, and Service Level Agreements (SLAs), as well as infrastructure libraries for service management and business integration must be made available. In the public cloud, there must be adherence to established frameworks as well provision for audits under various compliance acts.

Standards adopted may be determined based on the type of industry. The industrial standard may be dictated by the country or segment of operation and industrial vertical. For instance, the health care industry will be governed by HIPAA, while Sarbanes Oxley governs the financial industry in the USA and Canada. There may be sets of requirements and regulation by the industry itself for access control, security, protection of data, segregation of duties and lots more. The requirements for SLA may differ from one segment to another based on the amount of data processed, company size, and the kind of data. The regulation of the country, where the the company (or industry and/or service provided) is located may have an influence on the kind of standards adopted. Current tools and the available processes will also affect the standards adopted for the cloud. Implemented standards. You will need to consider customers and/or industry practises inside and outside the company / industry at the same time to refine the standards that should be implemented.

The current standards or requirements already established by vendors globally will have a huge impact on the standardisations and expectations. This is always obvious when software usage and licensing is involved. Industries need to always be mindful of the restrictions as well as the components that are not defined clearly; and also create practises that will not lead to unforeseen expenses, any kind of violations or breaches. For the fact that cloud is a combination of variety of technologies, standards need to be followed strictly, along with integrated compliance standards that may come up in the context.

In fact, cloud computing service providers must always investigate important areas for compliance and determine the minimum expectations from the regulatory authorities, clients, and competitors within the industry vertical.

How a Cloud Can Cover Needs Of Healthcare Industry?

August 17, 2015 Rob Mackle

Whenever data breaches or breakdown of cloud system occur, concerning people assume that the cloud is an insecure way of keeping bulk of data. Propensity of cloud system for breach does not let companies to rely on this system for hyper sensitive data. Fact is that, each cloud is developed with some specific purposes. There are cloud systems that are developed to handle important and sensitive information only. If you assume cloud cannot protect sensitive data from breaches, the reality is far from your assumption. For data protection, it is ridiculous to avoid the cloud; in fact, it is a matter of searching the right cloud to meet your needs.

You may have some know how about the Health Insurance Portability and Accountability Act (HIPAA); if not, you must be familiar with the word HIPAA. Basically, HIPAA is a sequence of codes that are responsible for formation, transmission as well as access of ePHI (electronic protected health information). Basic purpose of HIPAA is to keep important information of patients safe. As far as HIPAA compliance is concerned, healthcare providers are required to check data protection system and cloud is considered as fast and affordable method to address specific needs. For an IT provider, it is necessary to understand HIPAA requirements if they plan to serve the healthcare industry.

Protection & Access
It is simple to keep copies of data and transfer duplicate data to the cloud. The question arises, how valuable information will be protected from data breaches? What are the safety measures to keep information safe offline? Covered entities are liable to restrict physical access and make sure that information is encrypted in motion and at rest. It is absurd to think all clouds give same functionality. Always search for a provider that permits to encrypt information onsite. Data center selected for the protection of ePHI must give digital, as well as, physical safeguards to avoid unauthorized access.

System for Backup and Data Recovery
According to CFR 164.308, all covered entities must have backup, as well as, recovery plan in case of a disaster. In this regard, the cloud gives an advantage in the form of data protection, as offsite backup data is easy to recover when something unexpected happens with the onsite data backups. Additionally, many clouds are developed for fast recovery that is the foremost requirement of HIPAA. In addition to data backup, covered entities must be able to function in emergency conditions. For healthcare providers, it is highly beneficial to select a cloud designed to perform various functions to cover issues, such as data breaches, disaster recovery, and business continuity.

Conclusion
In short, the cloud is a perfect way to cover various features of HIPAA; however, it cannot deal with all aspects of data protection. For some people, HIPAA is more than a mess. In reality, it is nothing more than a set of safekeeping standards. For MSPs and VARs, it is essential to have in-depth knowledge of HIPAA before giving invincible service to the healthcare industry.

How Unpatched Software Give Way To Data Breaches?

July 3, 2015 Damien Garvey

It is a fact that IT related business is growing by leaps and bounds, and has changed the usage of organizational devices significantly within the last decade. With the growth of business, it has become essential to have some security measures. IT professionals have warned about risks associated with hyper-connectivity. Enterprises face great risks because the shortcomings of unpatched software are exposing data to cyber crime attacks. Therefore, it is the need of the hour to use advanced systems for data security.

Windows XP has lost its value due to security issues and instabilities which are associated with the operating system. When an OS developer like Microsoft cannot provide patches and critical updates to cope with security issues, the need for a new and well-defined operating system emerges.

What are the consequences of data breaches when complying with HIPAA (Health Insurance Portability and Accountability Act)?

HIPAA Breach Rule

HIPAA is an act related to accountability and health insurance portability. In order to give maximum protection and privacy to health information, federal law has set some rules and regulations. OCR (Office for Civil Rights) is responsible for enforcing security law. For data security, OCR gives notification to organizations when certain information is breached. When businesses do not apply latest software patches, customers could get affected by data breaches and their social security numbers and/or credit card numbers could be stolen; and as a result, HIPAA penalty could be levied. Organizations have been fined by OCR because many have become the victim of malware caused by failure in selecting software patches.

It is notable that HIPAA or OCR does not inform organizations to keep their software updated. When companies do not pay attention to software flaws and keep on working with patching software, issues such as data breaches become unavoidable.

How to Run System Smoothly?

To check data security, it is significant to use vigilant approach and observe applications of third-party against protection vulnerabilities. Unsecure data can be the result of supportive software or operating system that is functioning in the environment. To cope with data issues, security updates and advanced patches should be applied. For a small business or an enterprise, assistance of IT administrator is the only solution to get peace of mind.

In a nutshell, the penalty of data breaches should not be only in form of levying fines, but there must be some rules to meet the demands of industry. Organizations know methods to find out security risks and satisfactory solutions. In other words, patch your software and use updates to keep your data safe and secure. Organizations can improve ways of data protection by using cloud computing. As compared to public cloud, private cloud using companies are much more satisfied with security of data.