Your application vendor says its platform supports HIPAA compliance. That may be valuable. It does not tell you whether employees use secure devices, whether former staff still have access, or whether exported patient information is being handled appropriately.
The cloud changes the division of work
HHS permits regulated organizations to use cloud services for electronic protected health information, or ePHI, when the applicable HIPAA requirements are met. Its cloud guidance addresses business associate agreements and how responsibilities are allocated between the customer and cloud provider. A contract must fit the actual service and responsibilities. [1]
Ask the provider what its statement covers: which product and configuration, what contractual commitments apply, and which tasks remain yours. A business associate agreement is important where required, but signing one is not the same as completing every operational safeguard.
Your workflow extends beyond the application
Consider an illustrative example: an authorized employee exports patient records to an unmanaged laptop. The hosted application's controls do not automatically determine how that downloaded file is protected or shared.
Likewise, a secure hosting environment does not answer who disables a departing employee, reviews access, manages a lost device, or handles a suspected incident. These are questions about your complete workflow, including the people and equipment that interact with the service.
HHS describes administrative, physical, and technical safeguards, workforce training, access controls, and incident and contingency procedures. Its summary expressly addresses the Security Rule currently in effect, separately from proposed changes. [2]
Map responsibilities instead of buying duplicate tools
We recommend a written responsibility check covering identity and access, device management, sensitive exports and sharing, records of security activity, response procedures, and recovery. Name an owner for each item and identify what evidence shows it is working.
For authentication and device safeguards, select controls appropriate to the environment and risks. MFA, managed encryption, software updates, and restricted access can be important technical measures, but this article is not a determination of which specific implementation meets your legal duties.
A vendor's backup also needs a scope discussion. Ask which data it protects, how you request recovery, what happens during an outage, and which items outside its platform remain your responsibility.
Start with a risk analysis
HHS explains that risk analysis informs the safeguards selected to protect ePHI. The assessment must address the organization's environment, rather than relying on a product label. [3]
Your privacy or security officer and qualified advisers should evaluate the arrangement. An IT provider may itself require a business associate agreement when its work makes it a business associate; that depends on the actual services and access, not merely the provider's job title. [1, 2]
When an IT partner adds value
An outside IT partner can be useful when needed work is unassigned, your team lacks capacity, or you need help implementing and documenting technical controls. An internal team may already cover those duties well. There is no reason to duplicate effective work simply because a vendor recommends another service.
Blue Tree Technology® can help identify gaps between your cloud provider's responsibilities and your own technology operations, then propose a defined scope. We do not guarantee HIPAA compliance through a software purchase or service agreement.
This is general educational information, not legal advice. Confirm responsibilities and compliance decisions with your privacy/security officer and legal counsel.
Verification links
[1] HHS: Guidance on HIPAA and cloud computing
[2] HHS: Summary of the HIPAA Security Rule
[3] HHS: Guidance on risk analysis