Web-Tones

HITECH / HIPAA September 2011 Newsletter

This article explores the healthcare industry's emphatic adoption of cloud computing and the benefits and risks of moving to the cloud, including those directly related to HITECH / HIPAA Compliance.

What is the cloud?     The answer to this question is not as straightforward as it may seem because of the confusing jargon surrounding private clouds, public clouds, and community clouds. Here's a good overview of cloud computing. For the purposes of this article we are speaking of the benefits and risks associated with the public cloud. The public cloud is what most mid-sizecovered entities and business associates are likely to find economically feasible (i.e. only larger organizations have the economic clout to pursue the private cloud option). Is the healthcare industry moving to the cloud? Yes, the healthcare industry is moving to the cloud in a big way and we applaud the move. Cloud economics will contribute to bending the healthcare cost curve, although not nearly as much as creating a functional healthcare marketplace based on patient outcomes and transparent pricing (something we are not likely to see anytime soon). Dr. Halamka does an excellent job in this post in making the argument as to why the healthcare industry has been slow (understatement) to adopt enabling technologies. Fundamentally, his argument can be summarized as a "structural" justification for slow adoption. The industry simply had no real incentive to adopt enabling technologies, the status quo worked just fine (not really) thank you very much. However, now the industry is being pushed to change because of disruptive forces, not all of which are based on government incentives. So healthcare is being hit with a "perfect storm" of change and has decided to embrace cloud computing as part of its change strategy. The industry has not only embraced the cloud but put such a bear hug on it that healthcare is now the fasting growing IT verticle because of it.  The movement of the healthcare industry to the cloud is unstoppable, but this should not obscure the real downside risks that must be managed as part of this process. Generally the risks are a direct result of losing control of mission critical applications and infrastructure. Before discussing the risks let's highlight the real benefits that the industry is likely to derive from cloud computing.

To read the rest of the article subscribe to our FREE Newsletter here.

Healthcare in the Cloud: Don't Trust and Verify?

President Reagan once said in the context of a nuclear treaty with the former USSR (and apparently on other occasions): "Trust, but verify."  With respect to moving to the cloud, especially with PHI, our modification of this wisdom is: "Don't Trust AND Verify." The S&P Rating Agency, allegedly the watchdog for the financial industry, was entirely MIA during the sub-prime fiasco, which we now know nearly caused the collapse of the world financial system. The lesson learned is that although third party healthcare compliance "verifiers" (e.g. HITRUST, SAS-70, ISO 27000, etc.) have a role to play, one should not accept a rubber stamp that a particular cloud vendor/business associate is "safe" to do business with simply because of a third party endorsement. Perform your own rigorous due diligence and accept third party verification as perhaps "necessary but not sufficient." 

There are compelling benefits associated with cloud computing, but there are also significant downside risks that must be addressed. Most of these risks can be mitigated (but obviously not eliminated) with the appropriate contractual terms and conditions in place. However, because the cloud is a relatively new environment, many unsuspecting covered entities may not even know the right questions to ask. We highly recommend that you seek advice of counsel to help you negotiate these contracts.

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Business Associate Due Diligence?

Healthcare in the Cloud: Dealing with Disaster Recovery?

Healthcare in the Cloud: Why healthcare is different and why it matters?

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH/HIPAA experience?

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Vendor lock-in has always been an issue with major software and hardware purchases. An organization commits so much money and organizational resources to a particular application, database, email system, network, server architecture, etc. that it becomes next to impossible to migrate to something that might be better, faster, and cheaper.

Lock-in is nothing new but may be significantly more insidious on the cloud. Consider the options available to you regarding migrating away from a cloud based EHR. All of your data now resides on the cloud. Even if you have been replicating your data on a daily basis to a server under your control, that is not enough because you still don't have a copy of the application (which again resides on the cloud) to access it.

What do you do? There are no easy answers here. One option may be to ask the vendor upfront to place the Service in a software escrow account and update the account whenever the Service changes (or at some other stipulated to contractual interval). Should you wish to migrate from the vendor's Service and the vendor is either too slow to respond or uncooperative, you could access the version of the Service in escrow.

However you choose to attack this problem you need to think it through and include the necessary terms and conditions in the contract. Termination rights and how the parties proceed if a dispute arises are critical terms to get right.

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Business Associate Due Diligence?

Healthcare in the Cloud: Dealing with Disaster Recovery?

Healthcare in the Cloud: Why healthcare is different and why it matters?

Healthcare in the Cloud: Don't Trust and Verify?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH/HIPAA experience?

 

Healthcare in the Cloud: Business Associate Due Diligence?

Until the HITECH Act was enacted into law on February 17, 2009, as part of ARRA, a business associate's compliance with HIPAA's Regulations was mandated only as part of the contract (see 164.504(e)(1) ) with its respective covered entity. Under HITECH a business associate is "directly on the hook" for complying with the following sections of the HIPAA Security Rule:

1. Administrative Safeguards (see §164.308 );
2. Physical Safeguards (see §164.310 );
3. Technical Safeguards (see §164.312 ); and
4. Policies and Procedures and Documentation Requirements(see §164.316 ).

Business associate compliance with the required sections of the Security Rule were to go into effect one year post the enactment of HITECH, however, HHS (circa February 2010) delayed the compliance effective date for business associates, apparently to provide a little more breathing room to the impacted entities.

However, the requirement that business associates comply with the Security Rule is not going away, and therefore should be made part of the Business Associate Contract. The question for a covered entity that is moving to the cloud and sharing PHI is "how does it go about performing the required business associate due diligence?" Simply asking whether the business associate complies with the Security Rule and incorporating mandatory compliance into a contract is not likely to be enough. A better approach is to automate the business associate due diligence process using questionnaires as exemplified by The Guard.

Regardless of how it is accomplished, a covered entity must perform sufficient due diligence to ensure that its PHI will be managed according to applicable law. A rigorous process is required in addition to the requisite contractual language if covered entities want to avoid a finding of willful neglect.

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Dealing with Disaster Recovery?

Healthcare in the Cloud: Why healthcare is different and why it matters?

Healthcare in the Cloud: Don't Trust and Verify?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH/HIPAA experience?

 

Healthcare in the Cloud: Dealing with Disaster Recovery?

Do you know what steps you will take if your mission critical cloud services go down? What are your backup plans for getting access to your applications and data? Remember, having redundant access to your data may not be enough, especially in those cases where your infrastructure and applications both reside on the cloud. In general, what you need is "hot swappable" redundant access for all mission critical systems hosted on the cloud, yet the cost of this redundancy, and the requirement in general, may not be readily obvious, especially not obvious to mid-size and smaller covered entities that may be less IT savvy than their much larger brethren.

Let's be clear, you are likely to see better uptime on the cloud than you will if you attempt to "roll your own" world class infrastructure. However, you will experience some downtime, it is simply a fact of life. The question is "how much downtime can you tolerate and what do you do if the downtime exceeds this threshold?" In short, you want to have a conversation with your cloud partners about redundancy and about failover. Redundancy implies that your data (and apps) are replicated to another data center in case the primary data center fails. Failover implies that that redundancy has been implemented in a way that enables the backup data center to takeover in a matter of minutes or hours (i.e. as opposed to days).

Whatever agreements you come to with your cloud partners regarding uptime and disaster recovery must be captured in a written contract. If these partners are business associates then we suggest simply including these additional requirements in your Business Associate Contract.

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Business Associate Due Diligence?

Healthcare in the Cloud: Why healthcare is different and why it matters?

Healthcare in the Cloud: Don't Trust and Verify?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH/HIPAA experience?

 

Healthcare in the Cloud: Why healthcare is different and why it matters?

The healthcare industry is moving to the cloud in a big way and we applaud the move. Cloud economics will contribute to bending the healthcare cost curve, athough not nearly as much as creating a functional healthcare marketplace based on patient outcomes and transparent pricing (something we are not likely to see anytime soon).

Dr. Halamka does an excellent job in this post in making the argument as to why the healthcare industry has been slow (understatement) to adopt enabling technologies. Fundamentally, his argument can be summarized as a "structural" justification for slow adoption. The industry simply had no real incentive to adopt enabling technologies, the status quo worked just fine (not really) thank you very much.

However, now the industry is being pushed to change because of disruptive forces, not all of which are based on government incentives. So healthcare is being hit with a "perfect storm" of change and has decided to embrace cloud computing as part of its change strategy. The industry has not only embraced the cloud but put such as a bear hug on it that healthcare is now the fasting growing IT verticle because of it.

The movement of the healthcare industry to the cloud is unstoppable, but this should not obscure the real downside risks that must be managed as part of this process. Generally the risks are a direct result of losing control of mission critical applications and infrastructure (i.e. assuming the movement is to a public cloud as opposed to a private cloud, although many small covered entities and business associates will have little choice in the matter).

There are many areas of risk that need to be managed but this post will focus on a particular risk that is quite subtle, and will impact healthcare more than any other industry. If you are using a SaaS application on the public cloud you just lost control of your application rollout strategy.

Vendors Control the App Rollout Strategy in a SaaS World

There is nothing more disconcerting than to have a SaaS vendor entirely change the user interface and underlying process of what you do in a mission critical application. The first time you are faced with this issue will be a rude awakening into one of the ugly downsides of the SaaS model.

Vendors have a market need to continue to evolve their offerings or risk losing market share. Users on the other hand become quite comfortable in doing things in a particular way and often have the attitude of "please don't fix what isn't broken." Why? Primarily because we (as users) only have so much bandwidth and would prefer not to climb yet one more learning curve.

This problem is compounded in healthcare, especially with clinical applications. Why? Because mistakes in healthcare kill people and this kind of change to a work process is likely to cause mistakes. Sure, you will get some warning that the application is about to change, BUT your training schedule will have to conform to the vendor's rollout strategy, something that is not likely to set well with clinicians.

We have gone through this process several times and it has been painful on each occasion. That said, we are still huge believers in the cloud because its benefits out weigh the costs, but that doesn't obviate the fact that the costs are quite real.

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Business Associate Due Diligence?

Healthcare in the Cloud: Dealing with Disaster Recovery?

Healthcare in the Cloud: Don't Trust and Verify?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?

Healthcare in the Cloud: Buyer Beware-Downside Risks are Real !

We have written in the past that healthcare in the cloud is exploding and that it is not going away ever. Many EHRs are located in a cloud near you and the cloud may even help you comply with HITECH's Meaningful Use requirements. The benefits of cloud computing in the healthcare industry are many, including:

1. Fast and easy access to patient data anytime and anywhere.
2. The potential to leverage best practices surrounding security and encryption.
3. The availability of large and centralized de-identified data-sets available for multiple uses including predictive analytics.
4. A robust communications infrastructure for home healthcare monitoring applications to plug into.
5. A transaction/usage based pricing model for state of the art hardware and software that enables the distribution of previous fixed upfront capital costs more evenly across time.

In short, we are big proponents of cloud computing and feel that the underlying economics far out weigh the downside risks. That said, you need to be aware of the risks because all is not "sweetness and light" in cloud computing land. Many of these risks can be mitigated with rigorous planning and common sense strategies.

However, the required rigorous planning probably won't get done due to implementation pressures and experience teaches us that common sense if often not all that common. This is especially true with respect to technologies whose organizational complexity is often hidden.

If you are a compliance professional you need to work closely with your technology organization to ensure that HITECH / HIPAA Compliance is not compromised when you move to the cloud. Below are some of the issues you need to consider in order to mitigate the risks related to losing control of your critical IT systems and infrastructure.

Disaster Recovery

Do you know what steps you will take if your mission critical cloud services go down? What are your backup plans for getting access to your applications and data? Remember, having redundant access to your data may not be enough, especially in those cases where your infrastructure and applications both reside on the cloud. In general, what you need is "hot swappable" redundant access for all mission critical systems hosted on the cloud, yet the cost of this redundancy may not be readily obvious.

Contractual Obligations

Moving your IT operations to the cloud in a significant way implicates a number of contractual issues your organization may not have faced before, including those pertaining to HITECH / HIPAA Compliance. For example, if you are sharing PHI with your cloud partners then you are required to have a Business Associate Contract in place with each. This contract is mandated by law and not optional. Many of the requisite contractual clauses are specified by statute/regulation. In addition, there are a host of non-compliance issues you may want to manage in the same contract (i.e. to avoid having duplicate contracts with each cloud partner) including, but not limited to, the following:

1. Assurances the cloud partner will comply with applicable law, including the HIPAA Privacy and Security Rules.
2. Service Level Agreements related to up-time, throughput, disaster recovery, etc.
3. Dispute resolution clauses including data/application migration provisions.
4. Breach notification clauses and indemnification for same.
5. Hidden tax obligations and responsibilities related to state nexus laws.

In short, the compelling economics that underpin cloud computing are not without some significant downside risks. These risks can be managed contractually but this adds an administrative cost that is often lost (i.e. not obvious)  in the rush to dramatically cut IT costs. 

Related Posts:

Healthcare in the Cloud: Vendor Lock-in, Termination Rights, and Dispute Resolution?

Healthcare in the Cloud: Business Associate Due Diligence?

Healthcare in the Cloud: Dealing with Disaster Recovery?

Healthcare in the Cloud: Why healthcare is different and why it matters?

Healthcare in the Cloud: Don't Trust and Verify?

---

 Looking for best of breed HIPAA Training?

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HITECH Survival Guide website and/or sign up for our free monthly compliance newsletter. Also, check out our FREE EHR Checklist.

If you need tools that will help with your compliance initiatives then check out the HSG Store. Do you need an Internet Lawyer with HITECH /HIPAA experience?