4 ms·

What were these records doing on AWS in the first place? AWS isn't HIPAA compliant, surely?

• statenjason 11y ago
  AWS offers a BAA with some services https://aws.amazon.com/compliance/hipaa-compliance/#What_Services_Can_I_Use_in_My_AWS_Account_if_I_Have_a_BAA_with_AWS https://aws.amazon.com/compliance/hipaa-compliance/#What_Ser...?
  • dragonwriter 11y ago
    Offering a BAA is necessary, but not sufficient, to be a HIPAA-compliant service.
• yureka 11y ago
  It can be! https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/
  • clarkevans 11y ago
    While Amazon offers a business associate agreement ("BAA"), our legal review found it to be unacceptable -- the BAA we were privately provided last year significantly deviates from the standard language recommended by the U.S. Department of Health and Human Services [1]. Notably, Rackspace's BAA is public [2] (I'm not associated with Rackspace) and reasonably supports the standard language (I am not a lawyer). [1] http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/contractprov.html http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden... [2] http://www.rackspace.com/en-us/information/legal/hipaabaa http://www.rackspace.com/en-us/information/legal/hipaabaa
    • FLGMwt 11y ago
      Would you happen to remember any issues your team had with Amazon's BAA that they didn't have with Rackspace's?
      • deleted 11y ago
        [deleted]
      • clarkevans 11y ago
        https://www.prometheusresearch.com/how-amazon-reminded-us-that-not-all-business-associates-agreements-baa-are-created-equal/ https://www.prometheusresearch.com/how-amazon-reminded-us-th... (2014) In particular, Amazon's agreement included: A clause that puts all of the burden for securing data on the CE. No terms outlining how the BA would respond to breaches of unsecured PHI. Lack of specification about the BA’s level of access to PHI. A non-disclosure clause. EDIT: Google Cache for this page... http://webcache.googleusercontent.com/search?q=cache:tzvzlVGSuwAJ:https://www.prometheusresearch.com/how-amazon-reminded-us-that-not-all-business-associates-agreements-baa-are-created-equal/ http://webcache.googleusercontent.com/search?q=cache:tzvzlVG...
• deleted 11y ago
  [deleted]
• odonnellryan 11y ago
  You'd be surprised (or many not!) of the percentage of healthcare companies which aren't HIPAA compliant.
  • josephpmay 11y ago
    But that's illegal...
    • angersock 11y ago
      Well, yes and no and yes and no. HIPAA doesn't actually protect you as much as you'd think--for example everyone who is signed on as a business partner (and similarly HIPAA qualified) can, if memory serves, view records.
      • karmajunkie 11y ago
        They can, but they are similarly bound to have audit records of access, restrict access to only those with a business need to the information, and most importantly, BA's have a duty to notify of a breech. Prior to HITECH it was only the provider who was obligated to notify of a breech—business associates could do pretty much whatever they wanted as far as CMS was concerned, though the data sharing agreements oftentimes had more teeth to them than HIPAA itself.
        • odonnellryan 11y ago
          Yes, "bound." However those things are never really checked.
          • karmajunkie 11y ago
            Seeing as how I'm the guy that used to do the checking, I humbly disagree.