Beginning Next Week: InsideCounsel will become part of Corporate Counsel. Bringing these two industry-leading websites together will now give you comprehensive coverage of the full spectrum of issues affecting today's General Counsel at companies of all sizes. You will continue to receive expert analysis on key issues including corporate litigation, labor developments, tech initiatives and intellectual property, as well as Women, Influence & Power in Law (WIPL) professional development content. Plus we'll be serving all ALM legal publications from one interconnected platform, powered by, giving you easy access to additional relevant content from other InsideCounsel sister publications.

To prevent a disruption in service, you will be automatically redirected to the new site next week. Thank you for being a valued InsideCounsel reader!


A quick guide to staying “cloud compliant” with new HIPAA rules

For most companies, fulfilling the new rules deadline is Sept. 23

In March, the Health Insurance Portability and Accountability Act (HIPAA) Omnibus Final Rule (PDF) went into effect. For most companies (there are a few exceptions) to stay in compliance, they must fulfill those rules by Sept. 23.

As reported on InsideCounsel last week, the updates expand the definition of “business associates,” who must follow the same guidelines as physicians and insurance providers. The new rules specifically address cloud providers, reading, “Document storage companies maintaining protected health information on behalf of covered entities are considered business associates, regardless of whether they actually view the information they hold.”

For companies eager to play by the rules, Internet technology magazine Sys-Con offers a “Cloud HIPAA Compliance Checklist”:

1. Ensure “business associates” are HIPAA compliant

Business associates and subcontractors should state in a signed agreement or contract that they and any of their subcontractors are HIPAA compliant. “As a business associate they must meet the compliance rules for all privacy and security requirements,” author Gilad Parann-Nissany, CEO of Porticor, said in his post on Sys-Con.

2. Have a data backup contingency plan

Either internally or through an external provider, institute a backup plan for data, disaster recovery and emergencies.

3. Protect data from internal and external threats

Be sure to have a strong security plan in place to protect data from all threats. Limit access to company data to only those who need it. “Physical safeguards need to be implemented to secure the facility, like access controls for the facility,” Parann-Nissany added.

4.  Implement technical safeguards

Have a plan in place to ensure proper transmission, storage and deletion of data. Be sure to monitor and control access. “Adopt strong encryption technology and develop a plan to ensure data is transmitted, stored, and deleted securely,” he said.

5. Put HIPAA Administrative Safeguards in place

With the help of a privacy officer, develop and implement an internal HIPAA compliance plan. “Ensure that policies and procedures deal with analysis of risk, management of risk, policy violations, and sanctions for staff or contractors in violation of the policy,” Parann-Nissany suggests.


Cathleen Flahardy

Bio and more articles

Join the Conversation

Advertisement. Closing in 15 seconds.