Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. As computer hard drives are getting overloaded with information, behavioral professionals are beginning to wonder which companies to trust with their client/patient information. Many data storage companies have developed robust services that clearly identify their status with regard to HIPAA compliance. This article then, is about several such companies, and a couple more who fail to pass muster.
While it is always possible to purchase an external hard drive to store your excess data, you may decide that cloud storage affords you many advantages, including the ability to access your data anywhere, anytime and from any device. Another big advantage to cloud storage with a proper service is their ability to help you protect your information from theft, corruption and inaccessibility. They should also offer you the legal protections of Business Associate’s Agreements (BAA) to safeguard “Protected Health Information” (PHI) if you are a covered entity – and even if you are not.
See my earlier blog posts about many states requiring privacy and security of client an patient data beyond those needed by HIPAA. Related HIPAA rules also require a few other processes that have to do with your policies and practices and not just the standards needed for technology you might purchase. Read below.
Companies that Claim to Offer HIPAA Compliant Services
Amazon – Amazon S3 is not HIPAA compliant out of the box, but Amazon AWS can be used to create HIPAA-compliant cloud storage. Amazon gives you dedicated servers and a BAA, but you have to configure it yourself. This white paper is available for directions on how to create HIPAA compliant information processing systems in the Cloud. The paper focuses on the HIPAA sections: The Privacy Rule and The Security Rule, and how to encrypt and otherwise protect your data.
BackBlaze – This service allows you to store and protect then restore a single file, a folder or all your backed up files from a web browser for free. There is an option to have a 128 GB flash drive FedEx’d to you or an external drive up to 3 TB for an additional fee. You can also access your files with the iPhone app. Here is their security page. Mac users will be happy to note that this software is accessible from Mac or IOs systems.
Box – This service claims to meet the obligations required by HIPAA, HITECH, and the final HIPAA Omnibus ruling. They sign BAA addendums for customers who have an Enterprise or Elite account. As with some of the other services in this group, customers are responsible for configuring a Box in a HIPAA compliant manner and for enforcing policies in their organizations to meet HIPAA compliance. Details of HIPAA and HITECH compliance are here.
Carbonite ProPlan – This service is available for businesses that need protection for unlimited computers and HIPAA Compliance.
CareCloud – Uses security data centers in multiple locations and protected by armed security personnel. Having your data securely stored in multiple places eliminates the risk of catastrophic data loss due to natural disaster, theft or sabotage. See their security information here.
Crashplan – CrashPlan PRO boasts an easy-to-use desktop and uses 448-bit Blowfish encryption, one of the most robust encryption methods available. Files are encrypted before they leave your computer and then transferred to their servers using 128-bit Advanced Encryption Standard (AES) protocol.
Egnyte – Egnyte’s “enterprise” product is for businesses seeking HIPAA compliance. They are willing to sign a BAA.
Google Drive – As of September 2013, Google Apps for Business allows a domain administrator to sign a BAA that covers Gmail, Google Drive, Google Calendar, and Google Vault. Being HIPAA-compliant isn’t as easy as opening any one of these accounts on any one of these services, but if your domain administrator can disable all other Google Services from the domain and make sure you keep appropriate password policies, etc, then Google Drive can be rendered HIPAA compliant for cloud storage.
Symform – Focusing especially on backup and disaster recovery, Symform is another enterprise cloud storage service that is willing to sign a BAA and claims to be HIPAA compliant. They provide several links to several whitepapers on their site.
What about HIPAA Compliant DropBox and iCloud?
iCloud – Apple refuses to sign a BAA, so your information is not protected or compliant with your requirement by HIPAA in iCloud. This service might be useful for storing
Dropbox – Dropbox is not HIPAA compliant. A close reading of HIPAA will show that it requires all aspects of a PHI file — even the name, which can potentially hold identifying information — be encrypted and private. Dropbox as a company has policies which render it non-compliant with HIPAA in a number of areas. For instance, DropBox keeps “metadata,” which includes the file name, rendering it insecure. HIPAA also requires audit controls, which DropBox does not offer.
What Else?
HIPAA also makes it clear that your obligations as a covered entity do not just stop at selecting an appropriate service. The HIPAA Omnibus Rule of January 2013 states that even with a signed BAA, the burden falls on you to secure your data, even when hosted at a HIPAA compliant cloud storage provider. You also must be in compliance with any local, state requirements that supersede HIPAA. Several states have such requirements, including California, Texas and other “consumer protection” states in the US. Many non-US countries have comparable requirements.
These are the some of the processes that must be encrypted to standards defined by HIPAA in the US:
- How you upload data into your storage server(s) must be encrypted to HIPAA standards.
- While on the storage server, your data must be encrypted to HIPAA standards.
- How you remove data from the cloud must be encrypted to HIPAA standards.
- All data downloaded from the cloud must be encrypted to HIPAA standards.
How can you go wrong?
This is an area where what you don’t know can hurt you. HIPAA requires that you know what you are doing and that you conduct regular risk assessments. The Office for Civil Rights and the Office of the National Coordinator for Health IT have released a free tool to help you assess this risk. See our TMHI blog post about this risk assessment tool. Ignorance is not a defense.
Let’s say you store files on any one of the popular storage companies and arrange to receive email notification that your file has properly been transferred or stored. If you receive that notice in your non-encrypted email box, you have created a vulnerability. Those security vulnerabilities are how you can inadvertently create HIPAA violations.
As we teach in our Certificate training program, as the covered entity, you need to be in compliance with HIPAA on many fronts, including the services you buy, how you assess your risk, and the HIPAA policies you develop.
More Information?
Essential Telehealth Law & Ethical Issues
Bring your telehealth practice into legal compliance. Get up to date on inter-jurisdictional practice, privacy, HIPAA, referrals, risk management, duty to warn, the duty to report, termination, and much more!
Finding a HIPPA Compliant Services that provides a security solutions that allows your organization to meet all your goals around HIPAA compliance is highly important and necessary. Ensuring that you are completely in compliance with HIPAA; I would suggest going with Logicworks’ cloud computing solutions. Logicworks (www.logicworks.net) provides a perfect complement for the range qualitative security and compliance concerns faced in the healthcare industry.
Sfax should also be added to your list. http://www.sfaxme.com
Hi Dr. Maheu,
Thanks for the great resource. It’d be great if you could consider adding TrueVault to your list: https://www.truevault.com
TrueVault is a HIPAA compliant API and cloud data store that makes HIPAA compliance easy for healthcare applications.
Thank you!
Backblaze and Crashplan are cloud backup providers. Dropbox, Box, and Google Drive are cloud storage providers.
The previous post by Scott brings an important point. It is very important that the component of HIPAA compliance is whether a BAA is in place among all the parties involved. Many services that advertise HIPAA, usually there is a caveat that unless you are an enterprise customer, they do not offer to enter into BAA, therefore if you are a small-time developer or a vendor, that can significantly limit your ability to claim the compliance to your own customers even if you are storing data on one of the services.
File hosting allows them instant web access to the file, and
team members can make edits and adjustments, then re-upload
and notify everyone of the changes made. After
having these all tools i hope you will bear the palm
in the competition. The time zones may vary since this service can be from anywhere all over the world.
Thank you for letting us know about this service. Its availability with DropBox certainly makes it worth investigating.
The problem is that Dropbox interacts with the data and will not sign a BAA. Sookasa and other encryption apps offer better protections for data, but this does not make keeping ePHI on a cloud server like DropBox HIPAA compliant.
Sync.com is another good HIPAA compliant Cloud Storage provider.
You should check out armor.com. We specialize in HIPPA and PCI in the cloud. Awesome stuff.
Thank you, Grant.
Thank you for this. Keep the the good work!
Thanks for every other informative web site. Where else
could I get that kiind of info written in such an idewal method?
I have a undertaking that I’m simply now running on, and I have been at
the look out for such information.
Thank you for your suggestion!
Thank you for your suggestion!
Alan, If a nationally-recognized company claims HIPAA-compliance, they can usually be trusted. Companies making fraudulent claims about HIPAA compliance can get into big trouble with various federal entities. Such claims are not made lightly. Just be sure to get a Business Associate Agreement (BAA).
http://www.onr.com – This company offers HIPAA compliant hosting services through the data centers they own. They have a file sharing and storage service that’s HIPAA compliant as well and charge per user.
Thanks for the article.
Hello,
Very nice post providing very usefull information about cloud storage and hipaa security system. I want to add one more name to your list as I found it very usefull for users http://strato-comp.com. They provide best services at best price.
Thnks…..
iDrive should be included in this list.
Thank you for your suggestion, Murray. Could you tell us why you like iDrive?
Tanya,
We’ll look into your suggestion, but could you tell us what you found particularly useful with Logicworks?
Well there is a range of reason I find Logicworks Compliant Cloud Hosting useful. Personally, I like Logicworks for the security they provide, the fact it allows me to meet HIPPA Compliance, and for storing and sharing data. They have been around for many of years so they have the reliability and security I was looking for as well. When you check out Logicworks I am sure you will find them a great pick as well for HIPPA compliant cloud hosting (www.logicworks.net/technology/compliance/hipaa-compliant-hosting )
Hi Marlene,
Thanks for this informative article! I also wanted to call your attention to Sookasa (https://www.sookasa.com/), which enables HIPAA-compliant use of Dropbox. Sookasa preserves the native Dropbox interface, making it extremely easy to use, and encrypts data at the file-level, so sensitive PHI is protected on the cloud and on all connected devices. It’s even safe if, say, a physician wanted to download something to his device. Sookasa also has a number of other compliance features, such as user and device blocking, audit trails, and more.
Thanks,
Chelsea
Thank you for letting us know about this service. Its availability with DropBox certainly makes it worth investigating.
Any update on your thoughts about Sookasa? Need simple solution for about 8 users. Most of these users are out in the field and are not very computer literate, so need simple like dropbox integration.
Foldergrid (http://foldergrid.com/) is also HIPAA compliant.
In addition, Microsoft Azure platform has been providing HIPAA BAA to its business associates. In terms of how you would form a BAA, just ask any sales representative at Azure to generate one. I asked Azure support people to do this for me and they were unable to help, but the sales side is very well trained to understand the BAA.
FYI – Crashplan Pro is not HIPAA compliant. Their enterprise product–PROe–is. Different infrastructure, different pricing, different implementation on the clientside.
” Dropbox is not HIPAA compliant. A close reading of HIPAA will show that it requires all aspects of a PHI file — even the name, which can potentially hold identifying information — be encrypted and private. Dropbox as a company has policies which render it non-compliant with HIPAA in a number of areas. For instance, DropBox keeps “metadata,” which includes the file name, rendering it insecure. HIPAA also requires audit controls, which DropBox does not offer.”
I can’t comment about Dropbox, but I don’t think this assertion about filenames is correct. I don’t think HIPAA holds any requirements over data that doesn’t contain PHI; ergo if you don’t store PHI (or a code or derivative bit of information that could reasonably lead back to the disclosure of PHI) in fields and locations like filenames, this wouldn’t be an issue.
I leave open the possibility that I could be wrong about this, but I’ve been studying the OCR guidance and the relevant sections in CFR and haven’t yet seen this requirement. If I’m wrong, could you please point out the requirement with a citation to validate it?
Hi Dr. Maheu,
Great list of vendors, I know it’s tough to stay updated on a constantly changing market.
Paubox (www.paubox.com) is another HIPAA compliant cloud storage and email encryption solution to add to the list. BAA’s are available with paid accounts.
Thanks!
update on crashplan – PROe is only crashplan product that is HIPAA compliant. Must pay one time $1000 set up fee. Then regardless of number of users/servers – must pay for 5 users $120each/year.
Take a look at Sync.com (http://www.sync.com), secure cloud storage with real data privacy.
Easy to use service with fully encrypted storage, syncing and advanced sharing features.
Designed for HIPAA compliance with BAA agreement signed on Sync Pro plans starting at $49/yr.
https://www.sync.com/features/
Yes, also use Sync. Works great. Their HIPAA compliance setup was pretty straightforward.
https://www.sync.com/healthcare/
I would like to add a provider to your list. BlueRay Concepts is a partner provider of Sharesync services which is HIPAA compliant. Sharesync is a HIPAA compliant cloud storage solution.
https://www.bluerayconcepts.com/sharesync-secure-file-sharing-and-storage/
Disclaimer – I work for BlueRay Concepts
David,
Thank you for your addition to our list.
I would also like to add a provider to your list.Sync.com is a HIPAA compliant cloud storage provider that my company choose because they were willing to sign a BAA.
Thank you, Maxwell.
Check out SmartFile.com, as they also claim to be HIPAA Compliant.
Victoria,
Thank you for taking the time to make a suggestion for our list. Please see our new Directory of Behavioral Products and Services: https://blog.telehealth.org/directory
Dr Maheu,
Do you have any thoughts about a Florida company called Technomad?
Richard,
I haven’t heard of them. Please share what you know and perhaps someone else will comment?
Great post!
Foiply should be added to your list. https://www.foiply.com/ Here are links to some of their HIPAA content https://www.foiply.com/hipaa-compliant-fax/ and https://www.foiply.com/hipaa-and-the-cloud/
Hope that’s helpful!
Cloud computing has been embraced wholeheartedly in the IT Industry for its efficiency, reliability and cost-effectiveness.
You may want to visit this site too! http://www.sbasetech.net/cloud-services/
Dinah,
From your message, we cannot tell what you need. Please give us more information and we will be happy to respond.
Marlene
GoDaddy sells a HIPAA compliant version of Office 365.
Does anyone know if it really is compliant?
Alan,
If a company claims HIPAA compliance, especially a big, well-known company, we can all pretty much trust that it is compliant. If it isn’t, the Federal Trade Commission (FTC) would hold them responsible for fraud. Other federal agencies would most likely get involved as well. I’ve actually heard very good things about Microsoft Office 365, so it could be a relatively good choice for your clinical practice.
Much appreciated, Joe. Thank you for contributing.
https://www.myworkdrive.com – This company adds cloud remote access and collaboration to Windows File Server based networks. Unlike complicated and insecure VPN software, MyWorkDrive adds an easy to use Web Browser interface along with HIPAA compliance feature like Two Factor, Detailed Logging and Data Loss Prevention. No data is stored in MyWorkDrive and remains in the companies control at all times.
Thank you for posting your information, Dan.
Very few services are actually HIPAA compliant, and those that are still have to be implemented appropriately. For most businesses, it is not practical to have onsite IT, versed in HIPAA law and security protocols, handle the proper setup and implementation of a compliant cloud environment. For most cases, your better off working with a company that will offer training, BAA, implementation, etc. which specializes in HIPAA security as well. You also want to look for a company that is US-based, in my opinion, since this is a US healthcare law and you need to be sure the company you work with will keep abreast of any changes.
Thank you for your comment. We encourage both vendors and professionals looking for vendors to visit our TBHI Buyer’s Guide for information about companies to consider: https://blog.telehealth.org/directory
I would suggest checking out Atlantic.Net. They offer HIPAA Compliant Hosting and they are SSAE 18 – SOC1 and SOC2 certified. They have managed security, encryption, and offer a Business Associates Agreement. They are also HIPAA and HITECH audited. Learn more here: https://www.atlantic.net/hipaa-compliant-hosting/
If you know the people at Atlantic.Net, please invite them to create a directory entry for themselves at https://blog.telehealth.org/directory. That directory is a free community service offered by Telehealth Institute, our sister non-profit. It provides free community services, including the Buyer’s Guide Directory for software and hardware and associated services of potential interest to the telehealth community. (Other HIPAA-compliant (compatible) companies are also invited to create their own profiles, too.)
Professionals using these services are cautioned to do their own due diligence, as TBHI or TI are not staffed to keep on top of all tech companies at all times. If anyone wants to know how to pick a tech company, I’d suggest they purchase our 1-hour webinar that outlines 30 questions to consider before buying video conferencing services. Many of those same questions can be used with almost any technology purchase. Click to see here for details of the TBHI webinars.
Filecloud is an awesome Cloud storage service we have been using for a long time. They are Hipaa compliant and always advice their clients and users on why it is extremely important, practices to follow and help every user get compliant with requirements. https://www.getfilecloud.com/file-sharing-hospitals-healthcare-organizations/
I remember i was given an hour long presentation for Hipaa compliance guidelines , importance and more details by them.
This is great information, Marlene! I have several healthcare clients that I just sent this article to. I know one clinic in particular uses DropBox to share office admin files (as that’s how they distributed to me, their outsourced IT provider) — I just hope they don’t have any ePHI data stored there! I’m curious, do you have a HIPAA compliant hosting recommendation? I need to migrate two clients onto a compliant server by year’s end. I found this article informative as to the variety of HIPAA providers available — https://webhostingprof.com/hipaa-compliant-hosting/ — but it would be helpful to find a “second opinion” as to which provider is most recommended from other IT consultants in the industry. Also, has anyone here used HIPAA compliant texting? One client was asking about that for patient communication, on-boarding, and scheduling. I was reviewing your HIPAA buyer’s guide — https://blog.telehealth.org/telehealth-buyers-guide/c/hipaa/ — and didn’t see any website hosts, but did see Spruce Health listed as a recommended texting provider. Anyone have experience with Spruce Health? Thanks!
I be thankful for the information you shared to us about HIPAA Compliant Cloud Backup. It is a great information to applies backup disaster recovery and also it can help to secure our storage.
Great post thanks for providing very useful information