Online Backup Compliance with HIPAA
It is important for Online Backup software to assist its users in compliance with HIPAA and all other government regulations.
The Online Backup Guide for Service Providers is a complete 196-page guide on starting and operating an Online Backup Service – the latest revision of Rob Cosgrove’s industry defining RBS Book originally published in 1987. The entire book is being published here, chapter by chapter.
RBackup and Mercury Online Backup Software are compliant with HIPAA, GLB, SOX and other regulations.
The Encryption Key generated by RBackup and Mercury is known only to the customer, and is never transmitted to the Server. Data stored in Unified Storage Servers and in compressed and encrypted archives are not accessible by the Online Backup Service Provider. A data management software with Name Matching features may also help you access your data more efficiently and securely.
The software is adequate to help companies comply with the Final Security Rule. It also complies with the Privacy section, even though Online Backup Service Providers are not “Covered Entities” as defined by the current rules, and thus are not required to comply with it.
In addition, RBackup and Mercury can help customers comply with other provisions of the rules as part of a larger data protection and disaster recovery plan. At the time of this writing there is no “HIPAA Compliance” certification for backup software, and it is important to note that under the current rules, no software is truly “HIPAA compliant,” because there are no regulations that specifically address backup and privacy software.
In 1996, a bill known as the Kennedy-Kassebaum Bill was passed by the U.S. Congress and signed into law by President Bill Clinton. The new law was known as the Health Insurance Portability and Accountability Act of 1996, or more commonly, HIPAA. It had started as a measure to ensure that workers could keep their health insurance when they changed jobs, while they also learn how long to keep your paystubs when you do this. By the time of its passage, it had become much more complex and far-ranging, affecting the vast majority of all health-care entities in the United States.
Because of the complexity and wide range of HIPAA, there has been and continues to be a great deal of confusion about how it applies to many areas, including Online Backup. This page will present a brief overview of HIPAA, and demonstrate how Online Backup can be a valuable tool in meeting the requirements of HIPAA’s Security Rule.
Who Must Comply
Those who must comply with HIPAA fall into two categories. The first category is Covered Entities. Covered Entities include all health plans, health care clearinghouses, or health care providers who transmit health information in electronic form.
The second category is the Business Associates of those Covered Entities. A Business Associate is someone who performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.
Business Associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.
However, persons or organizations are not considered Business Associates if their functions or services do not involve the use or disclosure of protected health information (PHI), and where any access to protected health information by such persons would be incidental, if at all.
Must Online Backup Service Providers Comply?
Online Backup Service Providers are clearly not Covered Entities.
Because Online Backup Services do not use or require disclosure of PHI, and any access to PHI by an Online Backup Service Provider would be incidental, if even possible, Online Backup Service Providers are not normally considered to be Business Associates, and are therefore not covered by the HIPAA Privacy Rule. However, some Covered Entities may wish to have a Business Associate Contract in place regardless. How this is handled is up to the individual Online Backup Service Provider.
Online Backup Services do clearly fall within the requirements of the HIPAA Security Rule. Covered Entities must be compliant with the Security Rule by April 21, 2005. Online Backup software and services are compliant today, and can provide a foundation for overall compliance.
HIPAA Overview
HIPAA consists of five parts:
1. Title1 – Health Insurance Portability – helps workers maintain insurance coverage when they change jobs
2. Title 2 – Administrative Simplification – standardizes electronic health care-related transactions, and the privacy and security of health information
3. Title 3 – Medical Savings Accounts & Health Insurance Tax Deductions
4. Title 4 – Enforcement of Group Health Plan provisions
5. Title 5 – Revenue Offset Provisions.
Fortunately, four of the five parts of HIPAA have no bearing on Online Backup. The one part that does apply is Title 2 – Administrative Simplification.
Administrative Simplification
HIPAA Administrative Simplification consists of two areas. The first is commonly referred to as the Transactions and Code Sets Rule, although it also covers standardization of identifiers. This Rule requires standardization in all health-related electronic transactions, such as electronic transmission of insurance claims, verification of insurance, statements, explanations of benefits, remittance advice, etc.
Online Backup is not a health related transaction, and is therefore not covered under the Transactions and Code Sets Rule.
The second area of Administrative Simplification is made up of two Rules, the Privacy Rule and the Security Rule. Because these two rules are where the most confusion arises, we will examine them in some detail.
Privacy and Security
Before the Privacy and Security Rules can be explained, we must understand what they are intended to protect. Both Rules are intended to safeguard any health-related information that can be traced to or used to identify an individual. Some examples of this type of information include name, address, Date of Birth, Social Security number, or any other identifier. This type of information is referred to as Protected Health Information, or PHI.
The Privacy Rule and Security Rule are intended to protect PHI in different ways. The Privacy Rule sets out limits on who can have access to PHI and for what purpose. The Security Rule regulates the Procedural, Physical and Technical means that are used to protect PHI.
Privacy
The Privacy Rule places limits on the ways that PHI can be used and disclosed, and requires accounting of disclosures. But it is relevant at this point to review how Online Backup works.
With an Online Backup solution, all information to be backed up is encrypted by the local client before being transmitted, using a key that is stored locally. Data is stored on the Online Backup Server in its encrypted form. Data can only be recovered by transmitting it back to the local client, which decrypts it, again using the locally stored key. The most important feature of this arrangement is that while the data is stored on the Online Backup Server, it is encrypted and not in a readable format. The remote server does not have access to the key, and without the key, the data cannot be converted to a readable format.
Online Backup Services do not involve the use or disclosure of PHI. All backup data is stored on the Online Backup Server in an encrypted form, and any access to PHI by an Online Backup Service Provider would be incidental, if even possible. Online Backup Service Providers are therefore not normally considered to be Business Associates, and are not covered by or required to be compliant with the HIPAA Administrative Simplification Privacy Rule. You can also check it out to learn more about how Privacera can help you encrypt your data.
Security
The Security Rule is the one part of HIPAA that clearly applies to the type of services that Online Backup offers. The Final Security Rule was published in February 2003, and became effective on April 21, 2003.
The Security Rule legislates the means that should be used to protect PHI. It requires that covered entities have appropriate Administrative Procedures, Physical Safeguards, and Technical Safeguards to protect access to PHI.
Examples of appropriate safeguards include:
- Establishment of clear Access Control policies, procedures, and technology to restrict who has authorized access to PHI.
- Establishment of restricted and locked areas where PHI is stored.
- Establishment of appropriate Data Backup, Disaster Recovery, and Emergency Mode Operation planning.
- Establishment of technical security mechanisms such as encryption to protect data that is transmitted via a network.
RBackup and Mercury are compliant with the Final Security Rule.
Their Online Backup client software contains all appropriate technical security mechanisms to protect the data that is transmitted to and from the Server.
Online Backup can form a critical part of Data Backup, Disaster Recovery, and Emergency Mode Operations strategies by providing offsite backup that can be geographically distant from the client site to minimize the likelihood of data loss in a large scale disaster. In the event of loss of the primary data center, data on an Online Backup Server can easily be recovered from any replacement data center.
Online Backup, as part of a comprehensive security plan, can be an important part of compliance strategy.
Disclaimer: Please note that, although all information presented in this chapter is believed to be factually correct, this is not intended to give legal advice. Please consult with your legal counsel if you have questions about your specific situation.
Rob Cosgrove is the President of Remote Backup Systems, founder of the Online Backup Industry, and a vocal advocate for maintaining the highest standards in Online Backup software. His latest book, the Online Backup Guide for Service Providers: How to Start and Operate an Online Backup Service, is available online now, on Amazon.com, and at bookstores.
Remote Backup Systems provides brandable, scalable software and solutions to MSPs and VARs enabling them to offer Online Backup Services.
Tags:
HIPAA Online Backup