HITECH Business Associate Rule Tool Section 13: Implications for Cloud Services Providers – Updated January 25

PLEASE SEE THIS POST FOR MORE CURRENT INFORMATION: Do the HITECH Rules Really Make All Healthcare ASPS and Cloud Services Providers Business Associates?

Most of the basic analysis applicable to determining whether a could services provider is a Business Associate is the same as the analysis applicable to all types of application and IT services providers in Section 11. The analysis is highly fact-specific and principally considers whether or not the provision of services requires any routine access to PHI, and if not whether the vendor has the ability to access any PHI. The most prudent interpretation of this latter requirement is that the PHI is encrypted to the standards of the Security Breach Notification Rule guidance, and the vendor doesn’t have access to the encryption keys.

Categories

Tags

bill gates cert christiansen it blog cobiT coco contract law do it yourself ehr issues ehrs electronic health records electronic health recores electronic medical records eula hackers healthcare system healthy information networks hipaa hitech information security information security duty information security theory infosec integrated information security standard of care integreated information security it law it risk it security legal counsel medical records nasa dod hacker network security newbie lawyers opering system risk acceptance risk assessment risk management risk theory secuirty rule security incident response poilicy security legislation self help strategic information security ufo hacking vista windows vista

Worthwhile Links