A US hospital, a HIPAA covered entity, plans to store electronic protected health information with a cloud provider. The data will be encrypted, and the provider states it has no access to the decryption keys. Before migration, what does HIPAA require regarding the provider?
Select an answer to reveal the explanation.
Short Explanation
Encryption is a great lock, but HIPAA cares about who's holding the box. If your provider creates, receives, maintains or transmits ePHI for you, it's a business associate, keys or no keys. The trap is the no-view argument, which HHS guidance has specifically rejected.
Full Explanation
Under HIPAA, a business associate is a person or entity that creates, receives, maintains or transmits protected health information on behalf of a covered entity. HHS guidance on cloud computing states that a cloud service provider that maintains electronic PHI is a business associate even if the data is encrypted and the provider does not hold the key, sometimes called a no-view service. The covered entity must therefore execute a business associate agreement that establishes permitted uses and disclosures, requires appropriate safeguards and obliges the provider to report breaches and security incidents. Treating encryption as an exemption misstates the rule; encryption reduces risk and can affect breach notification analysis, but it does not change the provider's status. A SOC 1 report addresses controls relevant to user entities' financial reporting, and no audit report substitutes for the agreement HIPAA requires. Registering the provider as a covered entity confuses the categories: covered entities are health plans, clearinghouses and certain providers, while cloud providers serving them are business associates. Exam caveat: the HITECH Act made business associates directly liable for certain HIPAA requirements. Operational check: confirm a signed business associate agreement is on file before any ePHI is uploaded and that its scope covers all services in use.