OCR Warns of Risks from Cloud Computing and File Sharing Tools

by | Jul 5, 2017

The Department of Health and Human Services’ Office for Civil Rights (OCR) has issued a reminder to all covered entities and business associates of the possible risks associated with file sharing and collaboration tools, outlining the dangers these services can introduce and how covered entities can use these services while remaining in compliance with HIPAA Rules.

Even though file sharing tools and cloud computing services may include all the necessary protections to ensure data is safe and cannot be accessed by unauthorized individuals, in recent years there have been many cases where human error has resulted in systems being incorrectly configured, leading to data breaches.

A Metalogix survey carried by the Ponemon Institute showed that one in two organizations that uses the file sharing tool SharePoint had a confirmed data breach within SharePoint in the last 2 years. However this doesn’t mean that it has advised that SharePoint should not be used, nor that healthcare organizations should avoid alternative cloud and file sharing tools. Instead the Institute warns that, if these cloud services and tools are to be used, covered entities and business associates must conduct a risk analysis to identify potential risks to the confidentiality, integrity and availability of ePHI. After this is completed risk management policies must then be adopted to make sure those risks are lessened to an acceptable level.

Misconfigurations of a system should be discovered during a risk analysis, although OCR also advises that organizations conduct vulnerability scans. Scans should help covered entities locate potential vulnerabilities such as misconfigurations of software, obsolete software or missed patches. The recent ransomware attacks (WannaCry and NotPetya) have shown that missed patches and/or obsolete software can enable cybercriminals to gain access to internal networks and install malware.

OCR also advises that covered entities and business associates must complete a business associate agreement with cloud service providers prior to services/tools being put in place.

OCR points to official guidance it released last year on cloud computing services. The official guidance helps covered entities wishing to utilize cloud computing services to put in place the solutions while complying with HIPAA Rules.

The official guidance can be downloaded from OCR via this link.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy