[BreachExchange] Where is your PHI Data Traveling Today?

[Audrey McNeil]

https://www.lexology.com/library/detail.aspx?g=197651cc-8d38-4667-9a30-
1ae123da7037

With most vendors offering and pushing cloud computing solutions and
offsite data backup, or guaranteeing offsite backup of data they process
for you, many HIPAA covered entities and business associates are
questioning whether and how they can take advantage of cloud computing
while complying with regulations protecting the privacy and security of
electronic protected health information. At the same time, the rise of
offshore IT services, including distributed storage, by cloud data
providers creates issues that most healthcare providers have not yet
realized. Even if some of the issues are realized, many covered entities
and their business associates do not know where their data is currently
being processed, stored, or backed up. In fact, storage or processing of
personal health information (“PHI”) overseas may or may not be permitted or
at least require additional resources, such as additional or more detailed
risk assessments.

There currently are no federal regulations or statutes that prevent storing
or processing PHI offshore or overseas; however, the Centers for Medicare
and Medicaid Services (“CMS”), the U.S. Department of Health and Human
Services (“HHS”), and the U.S. Office of Civil Rights (“OCR”) within the
HHS, have all issued regulations or provided guidance that restrict storing
or processing PHI offshore. In addition, there are four states that ban any
Medicaid data from being stored or processed overseas (Arizona, Alaska,
Ohio and Wisconsin), two more that only allow offshore contracts under
extremely limited circumstances, and nine more that have specific
requirements that must be met before any offshore processing or storage of
Medicaid data is allowed. Even if a healthcare provider is not located in
one of the above states, if the provider has treated a patient of those
states, state regulators may argue that the healthcare provider must comply
with their laws, regulations, and guidance, as applied to the resident of
their state. Even more concerning is that even though Delaware does not
have any laws or statutes banning offshore processing or data storage,
Delaware recently started adding provisions to all of their contracts
(similar to Wisconsin) that the State (Delaware) will not permit project
work to be done offshore. There may be additional states adding these
prohibitions to their contracts in the future.

If extra regulatory burden and potential state law bans were not enough by
themselves, any PHI stored offshore likely will be subject to local law of
the country in which it is stored. Furthermore, these local laws may allow
for actions or even access to the data that directly conflicts with
requirements on healthcare providers under HIPAA/HITECH, even if the vendor
signed a BAA. Due to the issues in enforcing HIPAA and HITECH, and even a
BAA against an overseas vendor, HHS has basically stated that it is the
duty of the healthcare provider or vendor for deciding how to vet data
services vendors and comply with expected additional requirements when
conducting a risk assessment on overseas providers.

At this point, most healthcare providers question if any offshore or
offsite data storage or processing is worth any potential cost savings, or
if OCR has any further guidance. In the fall of 2016, OCR prepared guidance
that explained how federal health information privacy and data security
rules apply to cloud services. In summary, this guidance helped data
service companies, but at the expense of covered entities by primarily
placing the burden on the covered entities, specifically hospitals,
insurers, doctors, and other healthcare providers. In looking at data
service vendors, OCR decided that data service subcontractors of the
covered entities’ business associates are actually business associations of
the business associates. According to the OCR, covered entities must assess
the cloud services providers’ or offshore providers’ data security efforts,
but HIPAA does not require the cloud services providers to allow covered
entities audit them. As such, covered entities are required to determine
how well a cloud services provider handles system reliability, data
security, and data backup and recovery, without the ability to perform an
audit. While this is problematic when dealing with domestic cloud service
providers, it creates additional issues when dealing with overseas cloud
service providers.

While OCR allows use of overseas providers, as of right now the rules of
HIPAA and HITECH fail to address any international aspects, leaving no
requirements but also no protections for covered entities. If you select a
domestic provider, the laws and regulations regarding PHI apply to both
parties, but if an overseas provider is selected, HIPAA and HITECH will not
apply, unless they contractually agreed to comply with such laws and
regulations. If there is a breach and the overseas provider refuses to
defend against or pay any fines or fees levied related to the breach, the
covered entity may be liable for paying. It is also important to note that
while an international provider may agree to sign a BAA, many international
providers do not understand the requirements of HIPAA and HITECH, while
most domestic providers have a greater understanding.

Even if you know where the company with whom you are contracting is
located, do you know where they send the backup data? Do they send data for
processing or backup to other agents, subcontractors, vendors, or other
data providers overseas? You may not realize your data is regularly taking
international trips, and may be better traveled than you are. In addition,
if a relationship is terminated with an international provider, how will
you ensure that the data is wiped from the system? Healthcare providers
generally must require a certificate of destruction when terminating data
services, and will you be able to comply with this provision with an
offshore provider?

In contract with cloud service providers, including backup providers,
e-mail providers, and other processing entities, covered entities and their
BAAs must determine where their data is located, and if it is offshore,
they must analyze if any of the information is prohibited from being
exported by any state or local regulations. If not, next it must be
determined if there is an extra compliance burden associated with the data
being offshore, and if that extra compliance burden and the associated risk
of being offshore are worth any cost savings by using the offshore
provider. If an entity knows that some of its data may be banned from being
exported overseas, or would raise too much risk or compliance burden, then
language banning such exports should be placed in the agreements, including
any BAAs.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170824/ca777ea7/attachment.html>