The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued a reminder to all covered entities and business associates of the possible risks associated with file sharing and collaboration tools, outlining the dangers these services can introduce and how covered entities can use these services while remaining in compliance with HIPAA Rules.
Even though file sharing tools and cloud computing services may include all the necessary protections to ensure data is safe and cannot be accessed by unauthorized individuals, in recent years there have been many cases where human error has resulted in systems being incorrectly configured, leading to data breaches.
A Metalogix survey carried by the Ponemon Institute showed that one in two organizations that uses the file sharing tool SharePoint had a confirmed data breach within SharePoint in the last 2 years. However this doesn’t mean that it has advised that SharePoint should not be used, nor that healthcare organizations should avoid alternative cloud and file sharing tools. Instead the Institute warns that, if these cloud services and tools are to be used, covered entities and business associates must conduct a risk analysis to identify potential risks to the confidentiality, integrity and availability of ePHI. After this is completed risk management policies must then be adopted to make sure those risks are lessened to an acceptable level.
Misconfigurations of a system should be discovered during a risk analysis, although OCR also advises that organizations conduct vulnerability scans. Scans should help covered entities locate potential vulnerabilities such as misconfigurations of software, obsolete software or missed patches. The recent ransomware attacks (WannaCry and NotPetya) have shown that missed patches and/or obsolete software can enable cybercriminals to gain access to internal networks and install malware.
OCR also advises that covered entities and business associates must complete a business associate agreement with cloud service providers prior to services/tools being put in place.
OCR points to official guidance it released last year on cloud computing services. The official guidance helps covered entities wishing to utilize cloud computing services to put in place the solutions while complying with HIPAA Rules.
The official guidance can be downloaded from OCR via this link.
