Of all the industries which are benefiting from cloud based technology, the medical establishment is leading the list. Within hospitals around the world, cloud based technologies have enabled hospital managers to breathe easy in terms of documentation management, HIPAA compliance, cost reductions and access to vital patient/insurance records.
In this article we are going to explore the top five reasons why hospital managers love the cloud.
1. HIPAA Compliance via Cloud Hosting Infrastructures
HIPAA or the Health Insurance Portability and Accountability Act of 1996 was a bill designed to protect both medical professionals and patients against insurance scams, the leaking of confidential patient medical records and the rising costs of healthcare administration. Although originally signed in 1996, the bill was recently updated in January of 2013 to include emerging digital hospital management technologies, namely cloud applications, servers and infrastructures.
While we won’t get into the entire bill, the 1996 HIPAA guides how medical records can be kept, under what conditions they can be shown/transferred and how those medical records can be handled to minimize the cost of administration bills passed onto the client and the hospital provider.
The major reason why cloud based technologies have been a blessing for hospital managers is because cloud based technologies enable hospitals to outsource their IT infrastructure into companies which specialize in HIPAA compliant hosting. Before the cloud, most hospital managers relied on internal IT support staff to keep all patient and billing records within an internally self-managed data center. This meant the hospital staff was responsible for not only ensuring all medical records were compliant with HIPAA, it also meant hospital staff were responsible for managing the IT infrastructure they utilized.
For the hospital this meant hiring two sets of professionals: IT engineers to maintain hardware and legal medical professionals to maintain HIPAA compliance. The system proved clunky, overly bureaucratic and costly.
The major reason why HIPAA Compliant hosting is the number one reason hospital managers love the cloud is because the cloud has streamlined the process through competent outsourcing to a hosting company which specialized in HIPAA cloud hosting environments. Not only does HIPAA cloud hosting increase patient/billing document security, it downsizes on data center footprint, lessens the need for expensive IT/legal staff and removes hospitals from managing data center tech.
The other additional benefit of using a CSP (cloud service provider) for HIPAA compliant hosting is encryption. Above all things, the Health Insurance Portability and Accountability Act of 1996 lays out the framework for how medical records can be kept, who can access those records, under what circumstances those records can be accessed and though what avenues all patient medical records can be transferred to another party.
Through CSP HIPAA cloud hosting, encryption levels are raised through standard regulations determining who not only has access to the aforementioned but who has access/stores all encryption keys. It should be noted, HIPAA compliant hosting means hospitals hold and maintain all encryption keys and CSP’s must ask for access to those encryption keys if any updates/fixes must take place.
The basic take away here is simple: HIPAA compliant hosting keeps the hospital, in terms of control of encrypted materials, in the driver seat. The CSP, while maintaining records, does not maintain access to them.
2. Stronger and More Granular Data Breach Protocols
Security is paramount with HIPAA. No hospital wants highly sensitive patient medical records to leak onto the open Internet and no patient wants to have their medical and personal financial materials seep out onto the web. For this reason, the Health Insurance Portability and Accountability Act of 1996 and the significant update written in 2013 mandate how and when data breach reporting must take place.
In the original act written in 1996, HIPAA stated hospitals had to notify the United States Department of Health and Human Services if, and only when, a client data breach posed, “significant risk of reputational, financial or other hard” to persons involved. The 2013 update amended the language to make the reporting of a data breach more consistent with cloud based technologies. The update mandates that a breach must be reported to United States Department of Health and Human Services unless the data leaked poses a limited risk that the patient health records have been reached by unauthorized use. As noted within the U.S. Federal Register:
“Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111–5.”
But why is this important? The change in language puts the weight on both the CSP and the hospital to report any unauthorized access to the United States Department of Health and Human Services. In short, the change protects patients medical records more than ever before.
This is a great change for hospitals because it means not only do they have to act in a more secure avenue (see maintaining encryption keys), it also means HIPAA compliant hosting companies have to continually beef up their security protocols to ensure patient records aren’t compromised under threat of government financial and legal penalties. Financial penalties can now range up to $1.7 million per calendar year and with continued non-compliance, shuddering of business capabilities. The specificity of the language is meant to scare CSP’s into action. This is great news for patients and hospital managers.
3. Long Term Patient and Billing Document Management
Another wonderful aspect of HIPAA cloud hosting compliance is long-term data management. In the past, companies who understood they needed to shield themselves against possible lawsuits, kept all records for a minimum of two years. Much like a reporter who keeps his/her reporting notebook for a minimum of three years to protect against source incrimination/distortion, smart companies maintained and kept billing, financial and correspondence for a minimum of two years.
One of the main reasons why HIPAA compliant cloud hosting is a blessing for all hospital managers is it states, in plain language, how long CSP and hospitals must maintain patient records for. The plain stated language follows:
“Physicians and hospitals are required by state law to maintain patient records for at least six years from the date of the patient’s last visit. A doctor must keep obstetrical records and records of children for at least six years or until the child reaches age 19, whichever is later.”
In addition, HIPAA compliance enables patients to view their own medical records. As noted:
“An individual can request his or her own medical records. The law also permits access by other “qualified persons.” This includes parents or guardians when they approved the care or when it was provided on an emergency basis. Attorneys representing patients may also request records, as can a committee appointed to represent the needs of an incompetent patient.”
This plain and simple language works out great for hospital managers because it mandates minimum record keeping dates, ensures all HIPAA compliant hosting sticks by those minimums under pain of financial/legal repercussions and lays out the groundwork for patients to gain access to their records while shutting out all the rest.
By imposing length of record keeping minimums, hospitals and CSP’s are domestically bound by the same law. As long as hospitals and HIPAA compliant cloud hosting solutions keep to the standard, both parties protect themselves against damaging lawsuits and legal repercussions. With long term datastores as provided by Amazon Web Services (Amazon Glacier) and Google Compute Engine, long term medical record keeping is as simple as an encrypted bulk upload.
4. Elimination of Unencrypted Data Mobility
If you work for a publishing company, a restaurant or an institution which doesn’t require stringent data management protocols, taking work home from the office is as simple as an external USB stick or uploaded that data to a free public cloud storage utility like Google Drive or Dropbox. Yet, within the medical community, this type of cavelier data storage is not possible.
In terms of PHI data, protected health information, HIPAA compliant hosting eliminates the need for offsite data storage practices – USB, external hard drive, laptop – by keeping all data locked in a cloud architecture. Moreover, HIPAA compliant cloud hosting encrypts all data while in motion and while at rest. This means in the case of data being accessed by an unauthorized party, that data would still not be accessible and would remain secured unless that hacker, in addition to hacking into data, also hacked into and gained a specific encryption key.
As with most aspects of cloud computing and virtualized resources, the elimination of unencrypted data mobility with HIPAA compliant hosting is redundant to make sure unauthorized access never takes place.
5. Cost Savings
The last major reason why hospital managers and patients should love HIPAA compliant cloud hosting is cost savings. While we won’t get into specific cost savings, HIPAA compliant hosting eliminates/lessen the cost burden of the hospital to spend on the following:
- Investing in their own data center infrastructure
- Investing in IT hospital staff specializing in data center infrastructure management
- Investing in legal hospital staff to navigate HIPAA compliance
- Investing in self-maintained data encryption technologies
- Investing in long-term data stores
- Investing in traditional IT hardware needed for scale
- Investing in significant costs of security audits, certifications, and assessments as those costs are shifted to the HIPAA cloud hosting provider
These are but a few of the cost reductions a hospital can make when utilizing a HIPAA compliant cloud hosting provider.
For these aforementioned reasons and a few more, hospital managers should love HIPAA compliant cloud hosting.