How to Assess HIPAA Compliant Data Centers

The COVID-19 pandemic accelerated the technology-adoption pace of the medical sector. While the healthcare industry shifting to online processing models, HIPAA regulators didn’t impose any fines for non-compliance in 2019, allowing the telehealth sector to grow swiftly and offer online healthcare services.

With things returning to normal, HIPAA is back on its mission to ensure the security and data integrity of patients’ PHI. And the focus is on making all the data centers used for processing PHI HIPAA-compliant.

To be HIPAA (Health Insurance Portability and Accountability Act) compliant is to have measures and policies that ensure the security and integrity of patient’s Protected Health Information (PHI). This applies to patient records in physical forms and those used electronically. 

As a business owner using a data center for your electronic PHI (ePHI) activities, it is imperative to ensure that the data centers are HIPAA compliant. 

This gives an in-depth introduction to data center HIPAA compliance, why specific data centers are HIPAA compliant, and the best practices for using a data center.

What Makes A Data Center HIPAA Compliant?

The gold standard for HIPAA Data Centers is the HROC (HIPAA Report On Compliance) document. If a data center provider has their HROC compliance document, they can be considered a viable option for your ePHI processing activities.

It is crucial to engage a HIPAA-compliant cloud service provider, for your organization will be held responsible or might be held accountable for the damage publicly in the event of a data breach, regardless of the source of the breach.

For instance, Target was the victim of a breach via one of its HVAC (Heating, Ventilation, and Air Conditioning) service providers. This incident cost them $ 18.5 million in settlement fees, and the media and public held them responsible for the breach as ’one of their vendors’ was the source.

Here are a few things every HIPAA compliant data center should have in place:

• Documented disaster recovery plans
• Protection for its server hardware and other network assets by implementing physical access controls measures (such as Radio Frequency Identification and surveillance systems)
• Provision for security training material to ensure that all its users are kept informed on the latest security best practices
• Provision for IP separation to store ePHI separately from other general business assets
• Implementation of periodic and continuous risk assessments; periodical  sharing of results and best practices with all its stakeholders to ensure continued effectiveness in the shared responsibility model of data security
• Periodic internal and external audits to ensure valid data protection

How to assess HIPAA compliant data centers

HIPAA compliant data center service providers are primarily influential multinational organizations. For example, Google Cloud Platform (GCP), Amazon Web Services (AWS), Azure, and more. Therefore, it is unlikely that these service providers will fail to showcase their compliance towards HIPAA when asked. That said, having the know-how of HIPAA compliant data centers and the knowledge to ask the right questions could come in handy when signing up with an up-and-coming service provider. 

Here are a few ways to know if a data center service provider is HIPAA compliant.

Assigned security responsibility

The data center will have dedicated resources assigned to deploy new security measures and ensure that all the existing security practices work efficiently. 

Workforce Security

They can showcase the policies and measures they have implemented within their business to ensure that their employees are granted limited amounts of information.

Information access management

They can show that their employees are subject to role-based access controls and that every employee is granted access to systems and procedures according to their job roles.

Security awareness and training

They conduct routine and rigorous security training activities to educate their workforce on the latest security risks and share the best practices to ensure continued security.

Security incident procedures

They have documented policies and measures on incident response. These documents should include everything from threat mitigation to disaster recovery.

Contingency plan

They have listed physical or security incidents that could affect business continuity and have documented contingency plans that can be deployed for each instance.

Evaluation

They have policies and measures to ensure that their technical and non-technical policies are periodically evaluated to achieve the desired efficiency levels. The ones that fail to meet the requirement are patched or scrapped accordingly.

Business associate contracts and other arrangements

They have HIPAA business associate contracts in place to designate access.

Physical safeguards

They have physical safeguards in place to ensure that no security incident occurs physically. For example, they use RFIDs, and their physical server assets and network devices are always under continuous surveillance using cameras.

Technical safeguards

They have the technical safeguards to ensure that their vendors implement the best practices to ensure continued security

Want to achieve HIPAA certification with ease? Download our “How to Get HIPAA Certification – A Short 7-Step Checklist!” This handy guide simplifies the process into seven easy steps. Get your checklist now and make compliance a breeze!

What are the common approaches to utilizing data centers?

Your journey to choosing a HIPAA-compliant global data center will lead you to two types of data service providers. They are:

Data centers on-premise or HIPAA-compliant colocation

Cloud-based data centers or HIPAA-compliant private clouds

Depending on the volume of ePHI your business processes, the size of your organization and the associated risks, you can pick one that best fits your organization’s needs.

HIPAA-compliant colocation

A Colocation or on-premise data is when you run and maintain the data center on your premises. These are physical servers that are physically stacked in a server room. IT purists argue that on-premise data centers are the dinosaurs of computing. You can choose one for your processing activities based on your business needs and risk appetite. 

HIPAA-compliant private clouds

Cloud computing is the future. If your business does not foresee the need to set up its own on-premise data center, then you could onboard a cloud service provider.

Onboarding a service provider eliminates the need for you to spend time and resources on hiring and maintenance.AWS, Azure, and GCP are a few of the most sought-after HIPAA-compliant private clouds.

FAQ

Why do data center companies need to be HIPAA compliant?

As data centers store, process, and participate in transmitting protected health information, they become potential targets for hacks and bad actor instances. To ensure data protection, data centers need to be HIPAA compliant.

What are the approaches to finding HIPAA compliant data centers?

The best way to assess if a data center or data center service provider is HIPAA compliant is by reviewing their HROC (HIPAA Record of Compliance) document.

What is the importance of HIPAA compliant data centers?

Healthcare organizations have now identified the value and associated costs of going digital. However, this digital revolution has had its fair share of disadvantages too. Organizations now store and process PHI electronically either on a cloud database or a database whose servers are on-prem, thus making them potential targets for hackers looking to breach insecure online security systems. Attackers target data centers that process or store PHI and exploit vulnerabilities to gain access to millions of patients’ records. HIPAA compliant data centers help to minimize security incidents.