Healthcare providers and any organizations handling confidential digital data on their behalf are legally obligated to operate under stringent security standards. Two of these acts are especially important for all such entities operating in the US or providing services to US citizens: HIPAA and HITECH.
Introduced in 1996, HIPAA is meant to protect health insurance coverage for anyone changing or leaving their jobs as well as set basic data security standards pertaining to the protection of personal health information (PHI). The HITECH Act, introduced in 2009, expands upon the security and privacy protections of HIPAA.
Millions of organizations around the world rely on Microsoft Office 365 because it’s the industry leader in workplace productivity. However, some take it for granted that the system meets all compliance rules laid out by HIPAA and HITECH. Unfortunately, this is not the case, and compliance itself is largely your responsibility.
Luckily, Office 365 does provide the tools you need to ensure your organization meets its compliance obligations, but only with higher license levels. Furthermore, Office 365 is only compliant if your IT team sets it up in line with your internal security policies, which themselves need to be compliant. To make matters easier, it provides in-depth controls that help restrict access to patient data and secure that data when it’s being transmitted. The platform also helps you manage such matters with its Security & Compliance Center by allowing you to choose from predefined security configuration templates based on specific compliance regimes.
Which Companies Are Affected?
HIPAA defines two types of entities that must meet its compliance standards. These include covered entities and business associates. Covered entities refer to healthcare providers and related organizations, such as health insurance providers and clearing houses. Business associates are organizations that handle data on behalf of a covered entity, such as managed services providers, data-processing firms, accountants, and medical equipment providers.
The HITECH Act, which is effectively an extension of the HIPAA legislation, applies to exactly the same organizations.
What Are Your Responsibilities?
While Microsoft provides its customers with the tools they need to help maintain their compliance obligations, the responsibility largely lies with you. For example, you will need to make certain that your documents and data are stored in HIPAA- and HITECH-compliant systems secured with suitably strong multifactor authentication.
A common concern among companies regarding Office 365 and compliance is whether the included OneDrive cloud storage facility meets the necessary standards. Being a business associate itself, Microsoft does support HIPAA compliance, but you will need to sign a business associate agreement (BAA) before you can start using Microsoft’s cloud-based services for storing patient health information (PHI).
Unfortunately, HIPAA compliance is far more than just a matter of relying on HIPAA-compliant services such as those offered by Microsoft and other cloud providers. In fact, compliance primarily depends on users’ actions, hence the necessity to train your employees thoroughly and conduct an ongoing risk-management program that covers every department of your business.
How Compliance-as-a-Service Can Help
When it comes to compliance, it’s not so much about the tools you use as it is about how you use them. As such, there is no substitute for ongoing security awareness training and thorough risk analyses, as every organization has different requirements and challenges when it comes to data security. Furthermore, the legislation requires training and risk assessments.
A crucial point about compliance that many business leaders are still not fully aware of is that compliance is an ongoing process that evolves with technology itself. That said, every organization should view compliance not as a one-off project, but as a permanent service. That is exactly why many organizations are choosing to simplify matters by opting for compliance-as-a-service (CaaS), which gives them a highly configurable and customizable way to stay on the right side of the law.
Compliance is complicated, and there’s no way around it. But fret not -- F1 Solutions is here to help organizations with their fully managed security and compliance programs. Call us today to learn more about how our services can help you.
