Running ePHI systems on cloud or your own infrastructure: AWS and Azure business associate terms, what HIPAA hosting providers must sign and do, open-source tools for Security Rule safeguards, and on-premises responsibilities.
Hosting ePHI on AWS: accepting the Business Associate Addendum in AWS Artifact, keeping PHI in HIPAA-eligible services, why there is no HIPAA certification for AWS, SaaS partners' BAAs, and the safeguards that stay with you.
Hosting ePHI on Azure: the HIPAA BAA included in Microsoft's Product Terms, what it does not cover, SaaS customers' BAAs, Microsoft's position on customer-drafted BAAs, and the frameworks Microsoft maps to HIPAA.
What makes a hosting arrangement HIPAA compliant: the provider as a business associate even for encrypted data, the BAA, SLA terms OCR highlights, shared risk analysis, breach and incident reporting, and why HIPAA-certified hosting does not exist.
Which open-source tools cover Security Rule technical safeguards (unique IDs and MFA, audit controls, encryption and key management, backup and recovery, vulnerability scanning, asset inventory), their licenses, and the safeguards that tools alone do not meet.
What the Security Rule expects when ePHI systems run in your own facilities: facility access, workstation and device controls, media disposal and re-use, backups and recovery, and no cloud provider to share physical safeguards with.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.