HIPAA Compliance & Cloud EHR: Security Best Practices
A practical guide to HIPAA safeguards for practices using a cloud-based EHR, what to ask vendors, and the steps your own practice is responsible for.
Moving to a cloud-based EHR has real benefits, and practices are right to ask how patient data will be protected. This guide covers the HIPAA basics, what to ask a vendor, and what your practice still needs to do itself.
Understanding HIPAA Requirements
The HIPAA Security Rule sets national standards for protecting electronic protected health information (ePHI). It groups its requirements into three kinds of safeguards.
Technical Safeguards
- Access controls (unique user IDs, automatic logoff)
- Audit controls (recording and examining activity in systems that hold ePHI)
- Integrity controls (making sure data isn't improperly altered or destroyed)
- Transmission security (such as encryption)
Physical Safeguards
- Facility access controls
- Workstation use and security
- Device and media controls
Administrative Safeguards
- Risk analysis and risk management
- Workforce training
- Business associate agreements (BAAs)
What a Cloud EHR Can Help With
A well-run cloud EHR can take some security work off a small practice, because the vendor maintains the servers, applies updates and handles encryption. It doesn't make a practice compliant on its own. HIPAA compliance depends on how the practice uses the system, trains staff and manages risk.
When you evaluate a vendor, ask about:
- Encryption of data in transit and at rest
- Access control, including how one practice's data is kept separate from another's
- Audit logging of who viewed or changed patient records
- Backups and disaster recovery, including how often backups run and how restores are tested
- Security testing and audits, and whether results can be shared
- Business associate agreements, since you need a BAA with any vendor that creates, receives, stores or transmits PHI for you
- Data export, so you can get your records out if you leave
- Breach notification procedures and timelines
Get the answers in writing, and be cautious of vague phrases like "bank-level security" that don't describe a specific control.
Best Practices for Healthcare Providers
Even with a secure cloud EHR, much of the work sits with the practice.
Access Management
- Give each person their own login, and never share accounts
- Grant only the access each role needs
- Use multi-factor authentication wherever it is available
- Review user access regularly and remove it promptly when someone leaves
Staff Training
- Train all staff on HIPAA when they start and at least once a year
- Include phishing awareness
- Practice your incident response steps
- Keep records of training
Business Associate Agreements
- Keep a list of every vendor that handles PHI
- Have a signed BAA with each one
- Review vendors' security practices when you sign and periodically after
Audit Logs
- Know where your EHR's access logs are and who reviews them
- Check them regularly, and investigate unusual access
- Keep your HIPAA policies and related documentation for at least six years, as the Security Rule requires
Jogaza's Security Approach
Jogaza is a cloud EHR for psychiatric and behavioral health practices, designed with HIPAA safeguards in mind:
- Separated data: each practitioner's data is kept separate, and every request is checked against the signed-in user
- Access logging: every chart view and note change is recorded in an access log, and each patient has a record-access history
- Encryption: data is encrypted in transit and at rest
- Recording retention: AI scribe audio is deleted once it has been transcribed, and a practice can choose to have transcripts removed when a note is signed
- Locked notes: signed notes are locked, and corrections are added as dated addenda
Common Security Myths
Myth: "Cloud storage is always less secure than a server in the office."
Reality: It depends on who runs it and how. A small practice often can't match the patching, encryption and monitoring a dedicated vendor can provide, but you should still check what a vendor actually does.
Myth: "HIPAA prohibits cloud storage."
Reality: HIPAA doesn't prohibit any particular technology. HHS guidance confirms that covered entities can use cloud services, with a BAA and appropriate safeguards in place.
Myth: "If the vendor is secure, we're compliant."
Reality: The practice is still responsible for its own risk analysis, policies, training and access management.
Incident Response Planning
Breaches can still happen. Have a written plan that covers:
- Detection: how suspicious activity is noticed and reported
- Containment: limiting access and stopping further exposure
- Investigation: working out what happened and what data was involved
- Notification: meeting HIPAA's breach notification requirements for patients, HHS and, in some cases, the media
- Remediation: fixing the gaps that allowed the incident
- Documentation: recording every step taken
Conclusion
A cloud EHR can support HIPAA compliance well, but compliance is shared work. Choose a vendor whose safeguards you understand, get a BAA in place, and keep up your own risk analysis, training and access reviews.