In its latest subregulatory guidance, HHS has addressed the interaction of HIPAA's privacy and security rules with marketplace developments involving cloud computing. (For a discussion of HIPAA and cloud computing, see Practice Note, Cloud Computing and HIPAA Privacy and Security.)

Under HHS's guidance, a cloud service provider (CSP) is an entity that makes available online access to shared computing services having various levels of functionality. These services may include:

Related guidance from the National Institute of Standards and Technology (NIST) offers a more comprehensive definition of cloud computing.

HHS takes the position in its guidance that when a HIPAA covered entity (CE) uses a CSP to create, receive, maintain, or transmit electronic protected health information (ePHI) on the CE's behalf, the CSP is a HIPAA business associate (BA) in its own right. This includes when the CSP processes or stores ePHI. Also, according to HHS, if a HIPAA BA subcontracts with a CSP to create, receive, maintain, or transmit ePHI on the BA's behalf, then the CSP subcontractor is itself a BA. (Regarding subcontractor liability under the 2013 final HIPAA regulations, see Practice Note, HIPAA Privacy Rule: Business Associates.)

As a BA, a CSP is directly liable under HIPAA's privacy, security, and breach notification rules if it:

However, a CSP is not a BA if it receives and maintains (for example, to process or store) only information that is de-identified consistent with procedures under the HIPAA Privacy Rule. De-identified information is not considered PHI.

In some cases, a CSP may:

However, HHS indicated that a CSP that lacks an encryption key is nonetheless a HIPAA BA and must therefore satisfy the requirements that follow from BA status. According to HHS, lacking an encryption key for encrypted data that a CSP receives and maintains does not exempt the CSP from BA status. An entity that maintains ePHI on behalf of a CE (or another BA) is a BA, even if the entity cannot actually view the ePHI. In its guidance, HHS uses the term "no-views services" to describe a CSP that maintains encrypted ePHI on behalf of a CE (or another BA) without having access to the decryption key.

This means that:

In support of this conclusion, HHS cited certain limitations of encryption. For example, encryption does not:

The guidance addresses certain implications for no-view services arrangements from privacy, security, and breach notification perspectives, as follows.

Under the HHS guidance, CEs and BAs may use cloud services to store or process ePHI, provided that the CE or BA:

A CE or BA should understand a particular CSP's cloud computing environment or solution so that it can undertake a risk analysis and establish risk management policies (in addition to entering into a BAA with the CSP). (Regarding HIPAA risk analyses, see Practice Note, HIPAA Breach Notification Rules for Group Health Plans and HIPAA Enforcement and Group Health Plans: Penalties and Investigations.) For example, although a CE or BA may use cloud-based services of any configuration (for example, public, private, or a combination of the two), the configuration selected may impact the parties' risk analysis and risk management plans and, as a result, the BAA's provisions.

According to HHS, a CE or BA violates HIPAA's privacy, security, and breach notification rules if it uses a CSP to maintain ePHI without entering into a BAA with the CSP. In this context, HHS expressly referenced a recent enforcement action involving ePHI stored on a cloud-based server (see Legal Update, Despite Six Risk Analyses, University Must Pay $2.7 Million in HIPAA Settlement).

In general, HHS believes that a CSP that is a BA must satisfy HIPAA's privacy, security, and breach notification rules regardless of whether it has executed a BAA with the CE or BA that uses its services. However, the guidance addresses an affirmative defense that may apply if a CSP lacks actual or constructive knowledge that a CE or another BA is using its services to create, receive, maintain, or transmit ePHI. A CSP that becomes aware that it is maintaining ePHI must either:

A CSP in this situation generally is no longer a BA after it securely returns or destroys the ePHI.

A CSP that is a BA and experiences a security incident involving a CE's or BA's ePHI must report the incident to the CE or BA (see Practice Note, HIPAA Security Rule: Security Incident Procedures). The CSP also must adopt policies and procedures to address and document security incidents. HHS observed that although HIPAA's breach notification rules dictate the content, timing, and other reporting requirements involving breaches of unsecured PHI, the parties have some flexibility under a BAA to structure the reporting of other security incidents, including the level of detail, frequency, or format of incident reports (see Practice Note, HIPAA Breach Notification Rules for Group Health Plans).

CEs (including health care providers) and BAs may use mobile devices to access ePHI in the cloud if appropriate:

A CSP need not maintain ePHI for any particular period of time after it finishes providing services to a CE or BA. Under the Privacy Rule, a BAA must require a BA to return or destroy all PHI at the termination of the BAA where feasible (see also Practice Note, Disposing of Protected Health Information Under HIPAA).

If return or destruction is not feasible, the BAA must:

HHS indicates in its guidance that a CE or BA may use a CSP that stores ePHI on servers outside of the US, assuming a compliant BAA is in place. The government emphasized that:

CEs and BAs (which include CSPs) should factor these additional risks (for example, increased hacking attempts or malware attacks) in performing their risk analysis under the HIPAA Security Rule.

As with the HHS guidance received earlier this year in the individual rights space, these new cloud computing rules are only subregulatory in nature, and not the result of notice-and-comment rulemaking reflecting the regulated community's formal input (see Legal Updates, HHS Addresses HIPAA Individual Rights in FAQ Guidance and HHS FAQs Address Permitted Costs for Copies of PHI and More). Nonetheless, it seems fair to assume that HHS will use its new rules as a springboard for additional HIPAA privacy, security, and breach notification enforcement activity focused on cloud computing compliance. As a result, this guidance is required reading for CSPs and the CEs and other BAs that do business with them. At a minimum, CEs and BAs should determine whether they are treating CSPs as BAs (we suspect that many are not) and whether they have BAAs in place with these entities.

The guidance addresses a number of other issues including, for example, the documentation and auditing of CSP security practices.