HIPAA-compliant hosting: what to require
Key Takeaways
- When does a host need a written agreement?
- Which safeguards do the sections read here actually name?
- Does this page certify a host?
When does a host need a written agreement?
When the host, outside the covered entity's workforce, creates, receives, maintains, or transmits protected health information for a regulated function, or provides a service that involves disclosure of that information. That is the opening of the business-associate definition at 45 CFR 160.103.
The definition includes a subcontractor that does the same for the business associate (45 CFR 160.103, eCFR). Section 164.308 says a covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information only if it obtains satisfactory assurances, and the written contract or other arrangement is labeled Required (45 CFR 164.308, eCFR).
The eCFR says it is not an official legal edition. puna.one signs HIPAA BAAs. Signing a BAA is not a certification. Current hosting scope is on managed hosting.
Which safeguards do the sections read here actually name?
A required risk analysis, a required data backup plan, unique user identification, and audit controls. In 164.308, risk analysis is labeled Required: an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of electronic protected health information. The data backup plan is labeled Required: procedures to create and maintain retrievable exact copies.
Security awareness and training is a standard for all workforce members, including management. In 164.312, unique user identification is labeled Required. Encryption and decryption, and encryption in transmission, are labeled Addressable, which is not the same label as Required.
Audit controls require mechanisms that record and examine activity in systems that contain or use electronic protected health information (45 CFR 164.312, eCFR). The sections read here do not name multi-factor authentication, a firewall product, or WordPress. Ask the host which of the named safeguards the contract covers, and keep the covered entity's risk analysis and training in writing.
Does this page certify a host?
No. The sections read here do not create a certification of a host. Section 102.3 says civil monetary penalty amounts are adjusted annually and sets them out in a table that includes HIPAA administrative simplification rows under 45 CFR 160.404. This page does not copy that table's dollar columns (45 CFR 102.3, eCFR).
References
- eCFR. 45 CFR 160.103, business associate. Not an official legal edition. https://www.ecfr.gov/current/title-45/section-160.103
- eCFR. 45 CFR 164.308, administrative safeguards, including the business associate contract and the data backup plan. https://www.ecfr.gov/current/title-45/section-164.308
- eCFR. 45 CFR 164.312, technical safeguards. https://www.ecfr.gov/current/title-45/section-164.312
- eCFR. 45 CFR 102.3, penalty adjustment and table. Amounts are adjusted annually. Dollar columns are not copied here. https://www.ecfr.gov/current/title-45/section-102.3
- Current hosting offer: managed hosting.
The sections read here do not name TLS, a firewall product, multi-factor authentication, or WordPress. An HHS page stating that HHS does not certify hosts was not retrieved, so this page does not use that sentence.