Beginning Next Week: InsideCounsel will become part of Corporate Counsel. Bringing these two industry-leading websites together will now give you comprehensive coverage of the full spectrum of issues affecting today's General Counsel at companies of all sizes. You will continue to receive expert analysis on key issues including corporate litigation, labor developments, tech initiatives and intellectual property, as well as Women, Influence & Power in Law (WIPL) professional development content. Plus we'll be serving all ALM legal publications from one interconnected platform, powered by, giving you easy access to additional relevant content from other InsideCounsel sister publications.

To prevent a disruption in service, you will be automatically redirected to the new site next week. Thank you for being a valued InsideCounsel reader!


HIPAA updates bring compliance issues to the forefront for cloud services

With proper training and awareness, both healthcare providers and business associates can ensure compliance with new regulations

Back in the days when healthcare records were stored in giant filing cabinets in manila folders, security was a matter of having strong locks and restricted access. But today, with all of the benefits of electronic health records and cloud storage, matters are a bit more complicated. Healthcare providers have become accustomed to the stringent regulations – and associated penalties – of the Health Insurance Portability and Accountability Act (HIPAA) but now, with new regulations looming, other providers will be forced to align themselves with the latest provisions.

Cloud service providers, in particular, will need to be compliant with HIPAA if they plan to do business with healthcare organizations. Updates to HIPAA expand the definition of “business associates,” who must follow the same guidelines as physicians and insurance providers. In fact, the new rules specifically address cloud providers, stating, “Document storage companies maintaining protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold.”

Compliance Issues

The new HIPAA guidelines introduce a host of compliance issues that must be addressed, and business associates will now be held to the same strict regulatory guidelines as healthcare providers.

  • Breach Notifications: One major change involves the adjusted threshold for breach notifications. In the past, notifications were required when a data breach posed “significant risk of reputational, financial or other harm.” Now, however, providers and associates must notify the U.S. Department of Health and Human Services when unsecured data is breached unless a multi-factor risk assessment determines that there is a low risk of exposure.
  • Gap Analysis: In order to bring existing policies and procedures in line with the updated regulations, providers and associates should conduct a risk analysis to assess and address any gaps in policies and procedures, in accordance with 45 C.F.R. 164.308(a)(1) of the security rule.
  • Adjust Business Agreement: In order to ensure that all parties are aligned with the new provisions, both providers and associates must update and revise existing agreements, utilizing sample business agreements as provided by the Department of Health and Human Services.
  • Encryption Technology: As an additional safeguard, all parties should use encryption technology on protected health information, especially on portable devices, bringing a secondary level of security and minimizing the risk of exposure.

With proper training and awareness, both healthcare providers and business associates can ensure compliance with the new regulations, which, according to DHHS, will help avoid potential monetary penalties of more than $1.5 million in some cases.

Senior Editor and Community Manager

author image

Rich Steeves

Richard P. Steeves is Senior Editor and Community Manager of InsideCounsel magazine, where he covers the intellectual property and compliance beats. Rich earned a B.A....

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.