Cloud-based data centers, run by cloud-based providers, handle data management and storage for other organizations. For healthcare organizations, these cloud providers would work directly with patients’ protected health information (PHI). Moreover, healthcare organizations increasingly utilize cloud-based data centers to house and organize medical-related files.
In other words, cloud data centers would process and/or store PHI for healthcare professionals through the Internet. Given this, they, like other business associates, would need to demonstrate their HIPAA compliance.
Related: HIPAA compliant email: The definitive guide
What is a data center?
Data centers provide controlled environments that ensure the availability, security, and efficiency of a business’ data and applications. They are needed by different types of industries, such as healthcare, that rely on storing and processing large amounts of data. That is because they let organizations store data securely while scaling their operations and guaranteeing uninterrupted access to critical information.
These centers consist of several components needed to ensure their systems run smoothly:
- Servers
- Networking equipment
- Storage systems
- Cooling systems
- Power infrastructure
- Personnel
Data centers can also support cloud computing, big data analytics, artificial intelligence (AI), and other emerging technologies that require advanced computational power and storage capacity. The provider of a data center would be responsible for the infrastructure that supports and holds the data. Therefore, they would have to safeguard the data that flows through their systems with strong physical and/or technical security controls.
The cloud and data centers
Cloud computing services refer to delivering computing resources over the Internet on demand. Cloud service providers deliver access to a wide range of infrastructures, platforms, software, and storage for numerous organizations at once. Examples of well-known cloud service providers include Amazon Web Services (AWS) and Google Cloud Platform.
Cloud-based data centers are third-party (off-site) facilities operated by these cloud service providers. Such data centers could accommodate numerous servers and storage systems to support the scalability and flexibility requirements of cloud-based services. They would be responsible for data maintenance, updates, and, of course, security, just like physical data centers.
See more: A guide to HIPAA and cloud computing
The rise (and advantage) of the cloud in healthcare
In 2023, the global healthcare cloud market was valued at $46.55 billion; it was expected to grow to $54.28 billion in 2024 and $197.45 billion by 2032. Healthcare organizations use cloud services for storage, infrastructure/hosting, and software and file sharing. Providers have only just begun to gain an understanding of effective, secure, and compliant data management in the cloud.
Healthcare organizations that embrace new technologies, such as the cloud, can leverage data and digital tools to deliver better health outcomes. Examples of some of the benefits of cloud reliance include:
- Cost-effective data storage
- Better collaboration with other organizations
- Consistent access to medical files
- Minimized risks associated with onsite storage
- Reduced hardware investment and associated costs
The cloud offers covered entities the chance for significant growth, allowing them to focus on other patient-related tasks and proper patient care.
The risks of using the cloud
While cloud data storage provides some advantages, it also introduces risks related to data security, privacy, technical challenges, and service reliability. Cyberattacks are conducted against cloud-based providers as much as physical entities because of easy access where cybersecurity is lacking.
Known cloud security risks center on data security, loss, and sharing along with compliance and collaboration issues, such as:
- Greater attack surfaces for unauthorized access
- Increased data breaches
- Shared responsibility over security
- Accidental data deletion
- Uncontrollable service downtime
- Data ownership and control issues
- Collaboration challenges
Effective risk management in a cloud storage environment involves implementing security measures to circumvent the possible risks.
The cloud and HIPAA compliance
A recent survey by Bitglass suggests that adopting the cloud in healthcare still lags behind other industries due to HIPAA legislation. Under HIPAA, any cloud service provider dealing with PHI on behalf of a covered entity would be considered a business associate. These businesses would therefore be held responsible for the security of data in their care. Ultimately, they must be HIPAA compliant.
When healthcare organizations store PHI in the cloud (or any location), the handling of that data must comply with HIPAA. As with physical business associates, cloud service providers have to sign a business associate agreement (BAA) with healthcare organizations. A BAA states the business associate’s responsibilities and holds it liable for related HIPAA violations.
Furthermore, to be HIPAA compliant, a cloud-based data center would need to implement strong technical, physical, and administrative safeguards under the HIPAA Security Rule. Such safeguards would guarantee the confidentiality, integrity, and availability of PHI. In the cloud, these safeguards would involve securing the data and applications they store and run within the cloud.
Learn more: Preventing HIPAA violations
Cloud data security
Healthcare organizations are responsible for ensuring that their cloud business associates implement effective data security to support cloud activities. Depending on the needs of the provider and the organizations it works with such cybersecurity may include the following cloud-related safeguards.
Access controls: Implement multifactor authentication (MFA) to enhance user identity verification.
Data encryption: Employ encryption for data at rest and in transit so that even if accessed by an unauthorized party, the data remains unreadable.
Regular audits: Conduct regular audits and continuously monitor systems to detect and respond to unusual activities promptly.
Separate data backups: Maintain regular and redundant data backups, classifying and storing data separately, depending on the information and its needs.
Retention policies: Understand and configure data retention policies based on both the provider and the covered entity.
Data controls: Maintain clear visibility and control over where data is stored within the cloud and how.
Final thought: Finding the right HIPAA compliant storage solution
Kapua Iao
