Implement Access Control Requirements
This goes without saying, but lets just say it that providing public, unauthorized access to ePHI is a violation of HIPAA rules. HIPAA requires central identity management and necessitates the close control of access to data. Here are several best practices for implementing Access Control requirements in an AWS HIPAA-compliant environment:
How Does Hipaa Compliance Relate To Cloud Storage
A lot of people are afraid of the cloud. Its easy to think that once something is up there on the internet, its going to be free for anyone to see and take information from.
Fortunately, this isnt the case, but not all clouds are completely secure.
Cloud storage allows for easy access between different staff members in the workplace. No longer do you need to send information from one person to the next via phone call or email . Once the information is on the cloud, the right people will be able to access it while the wrong people wont know that its there.
It also allows for a lot more information to be stored and for that information to be stored securely. Cloud services are good because they receive frequent updates in safety and other important areas.
They also stop you from losing information during a tech emergency. The information is automatically backed-up so that you can avoid disaster.
The Introduction To Hipaa
The Health Insurance Portability and Accountability Act of 1996 sets the guidelines for how a persons protected health information is treated and safeguarded. Specifically, it spells out the rules for acquiring, modification, sharing, disclosure, transmission and protection of customer data by the specter of organizations engaged in providing healthcare and insurance services. Titled covered entities, these participants are required to abide by the law of non-disclosure of customers health data and facilitate its secure safekeeping and transmission. According to the law, the covered entity, which could be a health provider, pharmacy, insurance company, rehabilitation institution and other related parties are fully accountable for the integrity of information entrusted to it. The following requirements apply under the HIPAA legislation:
Privacy and confidentialityProtected health information should not be disclosed to unauthorized parties without consent of the bearer. This includes non-disclosure to employers, third-party individuals or organizations not directly involved in providing medical, insurance services, etc. to the owner of the data.
ProtectionThe law imposes rigorous restrictions on how the information is acquired, stored and transmitted. Regarding electronic data management which is prevalent today, it states that the covered entity must implement modern authentication and encryption mechanisms to prevent inappropriate viewing or eavesdropping.
You May Like: How To Ship To An Amazon Locker
Try Dss Cloud Backups With Hipaa Compliance
In accordance to HIPAA, covered entities are obliged to assure their customers data is highly available and can be recovered in case the disaster affects its main storage repository. This type of redundancy is generally achieved through data backups which are placed at a geographically disperse location.
DSS backup solutions utilize Amazons proven AWS platform to store customer data. The software is deployed within seconds and helps to seamlessly backup customers data, transfer it to the cloud, and retrieve it any time its needed. The HIPAA requirements are addressed across every stage of the cloud backup transaction:
Encryption And Protection Of Phi In Aws
implement encryption, customers may evaluate and take advantage of the encryption features native to the HIPAA-eligible services or they can satisfy the encryption requirements through other means consistent with the Guidance. The following sections provide high-level details about using available encryption features in each of the HIPAA-eligible services and other patterns for encrypting PHI. A final section describes how AWS KMS can be used to encrypt the keys used for encryption of PHI on AWS.
Don’t Miss: How To Gift Amazon Prime
Reduces Time Reduces Cost Reduces Risk
Aws allows benefit of customers to reduce their cost to become HIPAA Compliant in AWS, and it significantly reduces the time required as well by avoiding costly delays and mistakes. We understand what AWS components are not supported in a HIPAA environment, which ones are supported, and how to implement them to meet the HIPAA standards. Connectrias staff will also assist you in getting a Business Associate Agreement signed with Amazon, and we will enter into a BAA directly with each of our customers as well.
Connectrias security controls and processes go far beyond AWS, and extend throughout our entire company to all of our employees. Each of our staff members are required to take and pass HIPAA Compliance certification, and we undergo an annual HIPAA HITECH Assessment by a qualified 3rd party assessor to ensure that Connectria and our employees continue to meet the HIPAA HITECH standards. Connectria provides access to our HIPAA Compliance Team at no additional cost in order to assist our customers with achieving their HIPAA Compliance objectives.
Many of our customers include Independent Software Vendors who serve the healthcare market and require HIPAA compliance. Some also wish to move their applications to a hosted Software as a Service model. Whether you are a Covered Entity, a Business Associate, or a technology provider to the healthcare market, Connectria can help you implement and manage a HIPAA Compliant environment in AWS.
S For Hipaa Compliance In S3
Your organization should consider the following steps, when building on Amazon S3, as well as other AWS cloud services.
Sign The AWS BAA
When configuring AWS cloud services in a HIPAA compliant manner, your organization must first sign a Business Associates Agreement with AWS. This agreement will lay out the responsibilities your organization must manage and that AWS must manage.
Set Administrative Policies
Organizations must create and manage HIPAA administrative policies. Additionally, organizations must conduct an annual risk assessment and perform periodic reviews on all policies, procedures, and technical implementation. Essential compliance policies include:
- Risk Management
- Vulnerability Scanning
- Employee Training, and more..
These policies define which individuals will be responsible for managing technical implementation and organization security plan. Dash platform can generate customized administrative policies.
Set Technical Controls
Alongside Administrative Policies, your organization must implement technical safeguards such as proper user authentication, audit logging, vulnerability scanning, and backup and recovery.
HIPAA compliance reaches far outside of just S3. For your AWS account as a whole, your team should determine the best architecture and solutions for logging, backup, and other technical controls. S3 technical implementation should include the following:
Read Also: How Do I Play My Amazon Music Playlist On Alexa
How To Ensure Hipaa Compliancy When Building Applications With Aws
While signing an AWS BAA does not give you straight-forward HIPAA compliance, services that are covered under the BAA allows you to build applications that address needs in the healthcare space that are HIPAA compliant.
AWS has several HIPAA-eligible services, including Amazon EC2, Amazon S3, Amazon Glacier and Amazon Redshift.
An approach called the Shared Responsibility Model allows you to maintain compliance with HIPAA regulation under your own supervision while using cloud tools. This works as though you are hosting data in your own data center, in which you have the control over which security you choose to implement to protect your content, platform, applications, systems and networks.
Whats Covered Under A Baa With Aws
Now that weve determined AWS will sign a BAA, the question is determining what cloud services provided by AWS are actually covered by their BAA.
We found the answer to that on their HIPAA Eligible Services Reference page. We should note that upon the time of this writing, the page was last updated on 24 March 2017.
The AWS BAA currently covers:
- Alexa for Business
- AWS Amplify Console
- Amazon CloudWatch Events
- Amazon CloudWatch Logs
- AWS Directory Services
- Amazon DocumentDB
- Amazon DynamoDB
- Amazon Elastic Block Store
- Amazon Elastic Compute Cloud
- Amazon Elastic Container Registry
- Amazon Elastic Container Service
- Amazon Elastic Container Service for Kubernetes
- Amazon Elastic File System
- Amazon Elastic MapReduce
- AWS Elemental MediaConnect
- AWS Glue
- AWS Greengrass
- AWS IoT
- AWS IoT Events
- Amazon Managed Streaming for Apache Kafka
- Amazon MQ
- AWS OpsWorks for Chef Automate
- AWS OpsWorks for Puppet Enterprise
- AWS OpsWorks Stacks
- Amazon Pinpoint
- Amazon Polly
- Amazon Relational Database Service
- AWS RoboMaker
- Amazon SageMaker
- AWS Secrets Manager
- AWS Shield
- Amazon Simple Email Service
- Amazon Simple Notification Service
- Amazon Simple Queue Service
- Amazon Simple Storage Service
- Amazon Simple Workflow
- AWS Systems Manager
- Amazon Textract
- Amazon Virtual Private Cloud
- AWS VM Import/Export
- AWS Web Application Firewall
- Amazon WorkDocs
You May Like: How To Link Your Amazon Prime To Twitch
The Data Backup And Disaster Recovery Implementation
Every entity that falls under HIPAA regulations must have developed an emergency plan how to protect ePHI data in case of a disaster. To avoid losing private and critical patients information you have to ensure that the ePHIs which are collected, stored, and used within your system are backuped and the backup and recovery processes are configured properly. Most AWS services allow you to configure backup and recovery processes, so you can restore the last stable state of ePHI if some information is lost. By using features such as EC2 AMI snapshots you will be able to meet most of the data backup requirements.
is HIPAA compliant and is the most popular options for securely managing scalable and durable backups of your data. With Amazon S3 you have several options on how to ensure the privacy and security of ePHI records. Amazon S3 provides client-side encryption to protect data in transit and additional server-side encryption to protect your data at rest.
Disaster recovery is a set of tools and procedures that aim to protect an organizations data and critical IT infrastructure in times of disaster. This is usually one of the most expensive HIPAA requirements to comply with. In AWS you can use global infrastructures to build fault-tolerant solutions that are highly resilient in case of network failures, system downtime and natural or human-induced disaster.
Implement The Transmission Security Requirements
As detailed in the AWS BAA, you must to encrypt all ePHI in transit. To secure data during transit, you should always use Secure Socket Layer endpoints for all services.
Using SSL certificates with very strong SSL termination policies can help you protect your stored ePHI. You need to have SSL certificate installed to encrypt the traffic between the client and the server. You can use AWS Certificate Manager to create an SSL certificate.
Also Check: How To Access Amazon Locker
When Is Aws In Breach Of Hipaa
When a BAA has been completed, users have been told the correct way to use the service, and when access controls and permissions have been set up properly. Misconfigure an Amazon S3 bucket and your data will be accessible by everyone who knows where to find it.
Documentation has been released on the correct way to set up Amazon S3 services and manage access and permissions. Sadly, since there are many ways to grant permissions, there are also several points that mistakes can happen, and simple errors can have grave consequences.
On many occasions, security experts have discovered unprotected AWS S3 buckets and have alerted healthcare groups that PHI has been left unsecured. However, security experts are not the only ones checking for unsecured data. Cyber Criminals are always on the prowl. It is far simpler for a hacker to obtain data from cloud storage services that have had all protections removed than it is to attack groups in other ways.
One of the errors that has been made time and again is setting access controls to permit access by authenticated users. That could be taken to mean anyone who you have authenticated to have access to your files or server. However, that is not Amazons definition of an authenticated user. An authenticated user is anyone who holds an AWS account, and anyone can register for an AWS account free of charge.
Aws Hosting With Quickblox
AWS provides everything you need to set up a HIPAA-compliant telehealth platform. But, ultimately you are still responsible for ensuring that your instance is configured in the most optimal way to follow HIPAA software security rules. QuickBlox HIPAA-compliance services can help you achieve these ends because it has a deep experience supporting communication solutions for healthcare. QuickBlox is a communication back-end provider with instant messaging and group chat, peer-to-peer and multiparty video calling, file sharing and other functions accessible through SDKs and APIs. QuickBlox can work with any cloud service provider, including Amazon Web Services, to help you set up your instance that follows best practices and data protection requirements. Contact us now to find out more.
You May Like: How To Find Someone’s Wishlist On Amazon
More About Architecting For Hipaa In The Cloud
Amazon Web Services helps you run sensitive workloads once they are regulated under United States HIPAA. To include highly protected health information under AWS, you need to accept the AWS Business Associate Addendum or AWS BAA. This is also where you can legally process PHI.
However, for this to be accepted first, you need to use AWS Artifact Agreements and confirm your account in the AWS. This is used to review, accept and manage all the agreements in your account. Next, you can review the terms of your accepted agreement, and if you dont feel the necessity to use the agreement, you can always terminate it. There is an AWS Artifact Agreements specifically for this.
You can to check on the current list of services covered by AWS BAA.
Will Aws Sign A Business Associate Addendum As Described In The Hipaa Rules And Regulations
Yes. AWS has a standard Business Associate Addendum we present to customers for signature. It takes into account the unique services AWS provides and accommodates the AWS Shared Responsibility Model.
To review, accept, and manage the status of the BAA for your account, sign in to AWS Artifact in the AWS Management Console. If you dont have access to your account, request a free IAM account from your administrator and ask for access to Artifact IAM policies.
Step-by-step: Learn how to use AWS Artifact to accept agreements for multiple accounts in your org.
See how to use AWS Artifact to accept an agreement for your account.
Also Check: How To Register A Kindle Paperwhite
Hipaa Is Your Responsibility Not Amazons
AWS operates under a , meaning they are responsible for certain aspects of security and compliance, while the user is responsible for others. While AWS has several tools, features, and services that make it easier to be HIPAA compliant, you should always remember that using AWS alone is not proof of compliance. Youll still need to make sure that you are following the standards. No software, platform, or healthcare technology can ensure total compliance. Only you can. Compliance is not a feature of AWS: It is the result of using it.
Does Aws Offer Hipaa Compliant Service
The Business Associate Agreement is a key component to HIPAA compliance between a covered entity and a business associate. Since AWS offers one, we conclude they are in fact a HIPAA compliant cloud vendor.
Make sure your email is HIPAA compliant too. Not sure how?We put together this free Quick Guide to HIPAA Compliant Email.
Read Also: How Much Does Amazon Cloud Cost
Audit And Log Keep A Log Of Everything
HIPAA rules dictate that you need to know who accessed a patients data and who changed it. After which, you must be able to verify that the changes were correct and the record is still valid. You must log all of these transactions and guarantee that you can easily produce reports when necessary, such as when audit time comes, or if you experience a breach.
What Is Hipaa Compliance
HIPAA is what protects patients from having their private health information and data released into the world. There are strict protocols when it comes to how private health information can and should be managed and shared.
Information needs to be accessible for the healthcare staff that needs it, but it needs to be safe from everyone else.
There are certain technical and physical safeguards required in businesses that need to be HIPAA compliant. This can become complicated when trying to have HIPAA compliant file-sharing or HIPAA compliant cloud storage.
Any time youre going to be sharing information on the web, youre risking it getting into the wrong hands. Whether its by mistake when someone accidentally miscategorizes a file, or if its a hacking situation from cybercriminals, the internet isnt always a safe place for secure information.
Letting that information leak out is going to be a HIPAA violation, even if all parties involved had the best intentions. This makes cloud storage a tricky subject, but it doesnt have to be.
Also Check: Is Starz Channel Free With Amazon Prime
Alternate Solutions For Amazon Aws Hipaa Compliance
If you want HIPAA compliant web hosting and cloud storage, there are plenty of alternate companies out there that can offer these services. There are companies that offer outsourced HIPAA hosting without the need to host anything on your own infrastructure.
Many hosting companies offer HIPAA compliant web hosting along with HIPAA compliant email and cloud storage. Some providers only offer HIPAA compliant hosting, for both small businesses and enterprises. All of these providers are capable of running a professional HIPAA compliant website or application.
With this type of arrangement makes, these companies are still seen as a business partner and they need to sign a Business Associate Agreement.
Covered entities should outsource to providers who advertise to be HIPAA compliant cloud storage providers and also those that are willing to provide a signature to a HIPAA required Business Associate Agreement.
Yet, even then, it is your responsibility to engage some method of risk analysis to ensure that the cloud storage provider you choose is compliant with all of the HIPAA requirements.
Violating HIPAA laws can be detrimental to your company. In addition to losing your customers trust, your company can face fines up to $250,000 and imprisonment for up to 10 years. Ensure to go with one of our recommended HIPAA compliant hosting service providers to stay above the law.