" ePHI Archives - LuxSci FYI Blog: Learn about HIPAA email encryption, secure email encryption, and more

Posts Tagged ‘ePHI’

Is Skype HIPAA Compliant? If not, what is?

Saturday, May 9th, 2020

Doctor using Skype for telehealth

In recent times we have seen a huge push toward telehealth, so many are wondering, “Is Skype HIPAA compliant?” While Skype is a practical tool that many people have access to, it’s important to consider any regulatory obligations you need to meet before you use it.

If your business collects, stores, transmits or processes electronic protected health information (ePHI), then it is subject to HIPAA regulations. Organizations that process ePHI on behalf of other parties also need to stick within the rules, otherwise they may face heavy fines.

Regardless of whether your organization provides health services through video or it uses video platforms to process ePHI in any other way, it needs to make sure it is using software that abides by the regulations.

Wondering, “Is Skype HIPAA compliant?” is a good starting point, but there are several things to consider before you commit to a video conferencing service.

Do You Need a BAA to Make Skype HIPAA Compliant?

A business associates agreement (BAA) is a contract between your organization and any others that process its data. In essence, these agreements outline how ePHI will be used, what control measures will be in place, and where the responsibilities lie between the two parties.

BAAs are absolutely necessary for HIPAA compliance. Even if your organization and its partner share ePHI with every control and security mechanism imaginable, as well as following all other aspects of the regulations, it would still be violating HIPAA if a signed BAA was not in place.

If your organization is going to be sharing ePHI over a video service, then it needs to be HIPAA-compliant.* However, the only way that it can be HIPAA compliant is if a BAA is in place.

Is Only the Business Version of Skype HIPAA Compliant?

Skype comes in several different versions, but the basic, consumer oriented one is not HIPAA compliant. The only type that offers BAAs and which could be made HIPAA compliant is Skype for Business, which is one of Microsoft Office’s business communication tools.  Note that “Skype for Business” is a completely different service than consumer Skype. 

However, it’s also worth noting that Skype for Business is currently being phased out in favor of Microsoft Teams. If you don’t already have a supported version of Skype for Business, you should look for HIPAA-compliant alternatives instead. Support for Skype for Business Online ends in 2021, while support for Skype for Business Server will be extended until 2025.

With this in mind, it’s probably not worthwhile pursuing any version of Skype for HIPAA compliance. If you use the basic version of Skype, you will be violating the regulations, and even if you can get Microsoft to sign a Skype for Business BAA, you may have to switch your software in 2021 anyway.

HIPAA-Compliant Alternatives to Skype

Considering that Skype for Business doesn’t have much time left and that it is not even the same as “regular Skype,” your organization will be better off finding a HIPAA-compliant alternative. One option is LuxSci’s SecureVideo, which was designed specifically to make it easy to stay within the regulations.

SecureVideo was developed from the ground up with HIPAA compliance in mind, ensuring that it became a practical video calling service that made security and compliance simple. The Zoom for Healthcare-based platform is great for telemedicine and other forms of sharing ePHI.

SecureVideo includes handy features like screen-sharing, file-sharing and virtual clinics, with a capacity of up to 100 participants. This makes LuxSci’s SecureVideo a convenient and compliant alternative to Skype.

 

* During the Covid-19 pandemic, HHS has waived responsibility for breaches through non-compliant video conferencing services, like Skype.  So, while Skype may not be compliant, it is OK to use during the pandemic.  However, as the pandemic subsides and this waiver is lifted, you should have transitioned to a service that is actually HIPAA compliant.

Secure & Compliant Remote Work: Coronavirus & Working from Home

Thursday, April 16th, 2020

working from home during coronavirus pandemic

 

Less than a month ago, a secure and compliant remote work policy may have been far from the minds of many in company leadership. Now that the coronavirus pandemic is steaming ahead, our personal and work lives have been flipped upside down and we are all struggling to make the necessary adjustments.

Many businesses have closed their offices and have employees working from home, which is a great compromise for keeping operations ongoing and allowing people to retain their incomes.

However, the sudden move to working from home is a big jump for many companies and their employees, particularly if an existing remote work policy isn’t in place. Organizations need to tread carefully, because, with certain exceptions such as telehealth, coronavirus doesn’t change their security and compliance obligations.

This is especially critical for organizations that process electronic protected health information (ePHI) and for employees that deal with valuable or sensitive data. If the appropriate precautions aren’t taken, companies could breach regulations like HIPAA or PCI DSS, and face the significant penalties that come with violations. 

They may also have their sensitive data stolen by cybercriminals or leaked through negligence, which could lead to all kinds of problems, ranging from the theft of intellectual property to blackmail.

How Can Organizations Establish a Secure & Compliant Remote Work Policy

Even in these difficult times, a secure and compliant remote work policy needs to be designed carefully. This will ensure that it meets the requirements of the company and its employees, as well as any legal obligations and the needs of customers and clients.

To address each of these needs, all of these stakeholders should be involved in the process. It’s critical to get legal advice, as well as engage security experts, to make sure that the policy and technical measures are adequate for your company’s unique circumstances.

A secure and compliant remote work policy should include:

 

  • Who is covered, when, and in which situations.
  • What the organization’s responsibilities and obligations are.
  • What the employee’s responsibilities and obligations are.
  • What hardware and software must be used, and in what configurations.
  • What security and privacy measures should be in place.
  • How reliability and availability will be ensured.

 

Companies may still have certain legal obligations for their remote workers, so a secure and compliant remote work policy needs to take these into account. For example, the company may still need to take measures to ensure that laws such as the Fair Labor Standards Act are followed, and that employees are working in a safe environment. 

Once your company has developed its remote work policy, it should have each of its employees sign it, so that they are aware of the expectations and committed to following them.

What Security Measures Do Companies Need as Part of Their Remote Work Policies?

The particular measures will vary from situation to situation, depending on a company’s setup, the regulations it is subject to, the data assets it has, as well as how it transmits and stores valuable or sensitive information.

Some measures for remote work, found in the HITRUST and other security guidelines, include:

 

  • All data should be encrypted when it is transmitted over public networks. FIPS-approved ciphers should be implemented in any of the security protocols used.
  • Wireless access points should be encrypted with AES WPA2 as a minimum security standard.
  • Emails and other digital messages should be protected from end-to-end and sensitive information should never be sent without encryption.
  • Faxes should only be used for protected information if more secure alternatives are not possible.
  • Employees should use VPNs to connect to corporate systems, and all traffic should flow through the VPN. Any access should be remotely logged and monitored. Unauthorized connections should be monitored and reviewed quarterly at a minimum, and appropriate actions should be taken after the review process.
  • Effective authorization systems need to be in place for privileged connections and for access to sensitive business information. Remote administration sessions should have heightened security measures in place.
  • The authentication process for remote devices should include additional measures on top of passwords, such as the verification of IP or MAC addresses.
  • Employee use of portable storage devices should be strictly controlled and the information should be encrypted. 
  • Any data transfers outside of controlled areas require approval and the details need to be recorded. Cryptographic measures need to be in place to protect the integrity and confidentiality of data when it is transferred.
  • Sensitive or valuable data should not be available to unauthorized individuals or left unattended. This includes leaving the information out on desks, on printers, or viewable by others on computer monitors.
  • External services (such as new SaaS vendors) should not be used to store or transmit information without prior approval.
  • Controls and training should be in place if personal devices are allowed to be used in the workplace.

Solutions for Secure & Compliant Remote Work

In the wake of the rapid spread of coronavirus and the significant changes it has brought, many companies are scrambling to provide secure and compliant remote work solutions to their employees.

This poses a significant challenge, because when new systems are implemented abruptly, it can easily lead to mistakes. If these errors involve data leaks or compliance violations, they can have huge long term consequences for businesses.

To minimize these risks, the best option is to use well-established and specialized solutions like LuxSci’s many offerings. All of our products are designed from the ground up to be secure and comply with various sets of regulations, as well as to optimize our users’ workflows, convenience and efficiency.

These services include our secure and HIPAA-compliant email service, as well as tools like SecureText and Secure Video. The rise of coronavirus may have been an unexpected interruption, but adopting LuxSci’s safe and carefully designed tools can help to prevent further threats from harming your business in these difficult times.

What We Call “Quasi-HIPAA-Compliance” 

Thursday, March 26th, 2020

HIPAA Stethoscope

Are your organization’s service providers really HIPAA compliant, or are they only quasi-HIPAA compliant?

What do we mean? 

Okay, we’ll be honest quasi-HIPAA compliant isn’t an accepted term yet but it should be.

When we talk about quasi-HIPAA compliance, we’re referring to setups and services that look like they’re HIPAA compliant and share some of the features; however, they may not be completely in line with HIPAA requirements if you actually use them in the way that you want.

Quasi-HIPAA compliance is common, particularly in popular services. It can also be incredibly dangerous for businesses because quasi-HIPAA compliance can lead organizations into a false sense of security, while they may be violating the regulations unwittingly.

What Is Quasi-HIPAA Compliance?

The best way to explain the concept of quasi-HIPAA compliance is through example. A quasi-HIPAA compliant service could come from an email-hosting provider, web-hosting provider, or an organization that offers a range of other solutions. 

If these providers are quasi-HIPAA compliant, they will include elements of HIPAA compliance, but the services may not be appropriately tailored to keep their clients within the lines of the regulations when used in various ways.  A provider may be willing to sign a HIPAA business associates agreement (BAA) with your company, but its services may not include the appropriate protections for compliance.

As a good example: Google is willing to sign a BAA with customers using its G Suite service.  However, Google does not actually provide HIPAA-compliant email encryption — so using G Suite email in a HIPAA context can immediately leave you in non-compliance and subject to breach. This is quasi-HIPAA compliance.  You assume that by signing a BAA, you can use the services as you like and be “all set.”  In truth, you need to really understand what is allowed and what is not allowed. You then need to either (a) avoid performing non-compliant actions, or (b) add additional measures to fill those gaps.

Business Associates Agreements & Quasi-HIPAA Compliance

A BAA is essential for HIPAA compliance. Your company can’t be completely HIPAA compliant if it uses the services of another entity without a BAA in place. It doesn’t matter if the entity’s services are technically HIPAA compliant, you will fall foul of the regulations unless a BAA is in place between the two parties.

Even if you do have a BAA with your provider, that alone may not be enough to keep your organization on the right side of HIPAA. The provider may not have the security measures that your organization needs, and instead have a carefully worded BAA that will leave you vulnerable.

Let’s say your email marketing service provider is a quasi-HIPAA compliant provider. It may not offer email encryption, or the necessary access control measures that your organization needs to safely send ePHI and other sensitive information.  The “HIPAA Compliance” may be limited only to data stored at rest on their servers; you may be very surprised to learn that an email marketing company offering “HIPAA compliance” does not recommend sending any sensitive data over email

The BAA offered by a company may be carefully worded to say that the service is technically HIPAA-compliant, but only if you don’t use it to send ePHI. This is legal, and the provider isn’t necessarily doing anything wrong by offering such a service, as long as this is clearly stated in the agreement.  Without understanding clearly what is actually “covered,” you leave yourself at risk.

The compliance and breach danger comes when organizations use quasi-HIPAA compliant services without completely understanding them. If they don’t take the time to do their research or thoroughly read the agreement, they could end up using the service in a way that isn’t covered under the BAA.

Doctor Video Conference

Dangers of Quasi-HIPAA Compliance

In our example, an organization might subscribe to a quasi-HIPAA compliant service and use it to send ePHI. If ePHI isn’t allowed to be sent via email or text under the BAA, and it’s sent without encryption and other security measures in place, then the messages will violate HIPAA regulations.

This is an easy trap to fall into for several major reasons. 

  1. BAAs can be complex and need to be studied carefully. 
  2. People make assumptions about what is actually covered by an organization’s “HIPAA compliance.”
  3. It’s very easy to accidentally send ePHI in an email. The definition of ePHI is broad, so employees can include ePHI in messages without even realizing it.

Even if your organization specifies that ePHI shouldn’t be sent through a particular service, all it takes is one mistake and your company will have a costly HIPAA violation on its hands. If your organization does use an email marketing service that’s only quasi-HIPAA compliant, then the restrictions on ePHI will prevent your organization from being able to market effectively, and to communicate properly with its clients.

How Your Organization Can Avoid Quasi-HIPAA Compliance

The most important way to protect your organization is to do your research beforehand, and make sure that any prospective provider will cover your intended uses properly. This means that you need to read through their BAAs to make sure that they are inline with your business’ requirements.

To save you some time, services like G Suite and the vast majority of email marketing services can be seen as quasi-HIPAA compliant, at best. Only providers that specialize in HIPAA-compliant services will be able to deliver the solutions that healthcare organizations and those that process ePHI require.

If your company needs true HIPAA compliance, then a provider like LuxSci is the best way to stay on the ride side of the regulations. We have been providing HIPAA-compliant secure email since 2005. Not only are our solutions tailored to abide by HIPAA, but we have also developed the services you need to conduct important business tasks.

We provide HIPAA-compliant bulk email solutions for clients that need to send at scale. These services are set up over our secure infrastructure, and we provide dedicated servers for clients that require it.

LuxSci focuses on both compliance and ease-of-use, so we have developed secure email hosting, email marketing, and transactional email solutions among our offerings. Our services help your organization comfortably market itself and conduct business, all while staying in line with HIPAA compliance.

LuxSci Pursuing HITRUST Certification

Thursday, January 30th, 2020

LuxSci is working toward its HITRUST certification as part of our constant efforts to meet the highest levels of security and compliance. The threat landscape and regulatory environment are ever-evolving, and LuxSci is on track to be HITRUST CSF Level 3 certified (for HIPAA and GDPR, among other things) by the third quarter of 2020.

While LuxSci already follows the best practices in a variety of areas, the HITRUST certification is an industry-standard, ongoing, evolving, independent third-party review that shows just how committed we are to providing secure and compliant solutions and which enables anyone to really trust that LuxSci is doing all the right things.

HITRUST is an association that was formerly known as the Health Information Trust Alliance. A group of organizations came together in 2007 to develop the HITRUST Common Security Framework (CSF). The HITRUST CSF includes elements of a variety of different standards such as:

  • HIPAA
  • ISO/IEC 27000-series
  • NIST 800-53
  • PCI-DSS

How Does the HITRUST Certification Help?

By establishing a framework that encompasses many other important sets of regulations, the HITRUST certification makes it easier to provably meet all of the different requirements in a streamlined manner.

The framework is especially critical for organizations in the healthcare field and those that process electronic protected health information (ePHI), but it is also useful for security and compliance in other situations, such as GDPR.

The HITRUST certification is beneficial for any organization that deals with sensitive, valuable or highly regulated data, whether it creates it, transfers it, or processes it in any other way.  This is because the HITRUST CSF certification not only makes it easier to manage risk and compliance, but it also demonstrates to other parties that these critical areas are being properly taken care of.

All of LuxSci’s central services fall within the HITRUST umbrella and will be HITRUST certified. These services include:

  • Secure email hosting
  • Secure email marketing
  • Secure high volume email sending
  • Secure web site hosting
  • Secure form processing

Once LuxSci finishes the HITRUST certification process, its clients can be even more confident that they have chosen a provider that places security first and that LuxSci is committed to staying on top of all of the HIPAA security requirements.  

HITRUST is not a “one and done” process, it is a process that requires yearly refinements, yearly third party reviews, and yearly recertification.

A HITRUST certification proves both that you have all of the needed policies and procedures for compliance (hundreds of them) and that you have properly implemented and are following these policies and procedures.  HITRUST requires organizations to actively prove they are doing the right thing.  It’s not simple. It takes a lot of work and attention and buy in from all levels of an organization.  This is what makes HITRUST so valuable.

LuxSci’s Existing Certifications

LuxSci is 100 percent HIPAA-compliant and undergoes yearly internal and external HIPAA audits, penetration tests, and other internal and external reviews to ensure it continues to go above and beyond the regulations.

On top of this LuxSci maintains a TRUSTe Privacy Certification.  This is a yearly third-party review of LuxSci’s privacy policies and procedures (kind of like a mini-HITRUST for privacy) to ensure that our privacy policies meet industry best practices.  This certification enables LuxSci to keep our US-EU Privacy Shield status.

These certifications ensure that your business can be confident in LuxSci’s services. They let you know that one of the most trusted service providers in the industry is guiding your organization through the security and compliance minefield.

The HITRUST certification is simply another step in our constant effort to ensure that we provide the highest degree of security and compliance in all of LuxSci’s services.

What Level of SSL or TLS is Required for HIPAA Compliance?

Thursday, January 2nd, 2020

SSL and TLS are not actually monolithic encryption entities that you either use or do not use to connect securely to email servers, web sites, and other systems.  SSL and TLS are evolving protocols which have many nuances to how they may be configured.  The “version” of the protocol you are using and the ciphers used directly impact the level of security achievable through your connections.

Some people use the terms SSL and TLS interchangeably, but TLS (version 1.0 and beyond) is actually the successor of SSL (version 3.0). … see SSL versus TLS – what is the difference?  In 2014 we saw that SSL v3 was very weak and should not be used going forward by anyone (see the POODLE attacks, for example); TLS v1.0 or higher must be used.

Among the many configuration nuances of TLS, the protocol versions supported (e.g., 1.0, 1.1, 1.2, and 1.3) anfd which “ciphers” are permitted have the greatest impact on security.  A “cipher” specifies encryption algorithm to be used,  the secure hashing (message fingerprinting / authentication) algorithm to be used, and other related things such as how encryption keys are negotiated.   Some ciphers that have long been used, such as RC4, have become weak over time and should never be used in secure environments.  Other ciphers provide protection against people who record a secure conversation from being able to decrypt it in the future if somehow the server’s private keys are compromised (perfect forward secrecy).

What level of TLS is required by HIPAA?

Given the many choices of ciphers and TLS protocol versions, people are often at a loss as to what is specifically needed for HIPAA compliance for an appropriate and compliant level TLS security.  Simply “turning on TLS” without also configuring it appropriately is likely to leave your transmission encryption non-complaint.

Read the rest of this post »

LUXSCI