We encourage covered entities and business associates seeking information about types of cloud computing services and technical arrangement options to consult a resource offered by the National Institute of Standards and Technology SP 800-145, The NIST Definition of Cloud Computing. Common cloud services are on-demand internet access to computing (e.g., networks, servers, storage, applications) services. CSPs generally offer online access to shared computing resources with varying levels of functionality depending on the users’ requirements, ranging from mere data storage to complete software solutions (e.g., an electronic medical record system), platforms to simplify the ability of application developers to create new products, and entire computing infrastructure for software programmers to deploy and test programs. This guidance focuses on cloud resources offered by a CSP that is an entity legally separate from the covered entity or business associate considering the use of its services. This guidance assists such entities, including cloud services providers (CSPs), in understanding their HIPAA obligations.Ĭloud computing takes many forms.

With the proliferation and widespread adoption of cloud computing solutions, HIPAA covered entities and business associates are questioning whether and how they can take advantage of cloud computing while complying with regulations protecting the privacy and security of electronic protected health information (ePHI).

Other Administrative Simplification Rules.Covered Entities & Business Associates has sub items, about Covered Entities & Business Associates.Patient Safety has sub items, about Patient Safety.

Mental Health & Substance Use Disorders.Special Topics has sub items, about Special Topics.Compliance & Enforcement has sub items, about Compliance & Enforcement.Breach Notification has sub items, about Breach Notification.

Is dropbox business hipaa compliant