HIPAA and the Cloud: Is Your Patients’ Data Safe or at Risk?

September 18, 2025

 

Sure, your dog pics and selfies are safe in the cloud… but what about your patients’ data?

When technology advances, your practice evolves too.

As a healthcare provider, your job is to keep your patients and their data safe. The Health Insurance Portability and Accountability Act (HIPAA) covers protecting this data, especially how it is stored. 

For example, what if a bad storm floods your practice and ruins an internal server?

With cloud storage, this isn’t an issue. Cloud storage is hosted elsewhere and accessed through an internet connection, keeping your practice’s Protected Health Information (PHI) safe. 

Cloud storage and computing are encouraged, but it’s up to your practice to utilize them compliantly. 

 

Best Tips for Using Cloud Storage

It’s time to do research before working with any cloud service provider. Some good questions to ask include: 

Does this organization highlight its HIPAA policy on its site?

Is it clear what safeguards they have in place to protect your data? Will they encrypt the PHI? 

Are the servers where PHI is stored located within the United States?  While this is not a HIPAA requirement, it’s considered more secure than other nations. 

Most importantly, is this cloud service provider aware of the extent of its HIPAA responsibilities? 

Cloud service providers are considered Business Associates (BAs) under HIPAA. While BAs might not deal with patients directly, they handle patient data and are required to follow HIPAA legislation. Cloud service providers are considered BAs whether or not they have access to the encrypted data. Since they store it, they are considered BAs. 

BAs must complete a Security Risk Analysis (SRA), train staff, maintain up-to-date documentation, and more, like any healthcare practice. 

Before working with a BA, it is essential to complete a Business Associate Agreement (BAA). BAAs are legal contracts with BAs that ensure both parties are aware of their responsibilities when handling PHI and define the course of action if a breach occurs. 

A BA and Covered Entity (or, healthcare practice) must complete a BAA before entering a business relationship. Your practice should also avoid working with BAs who do not want to be held legally responsible for handling PHI. 

Not having a BAA with your cloud storage provider can get you into hot water with HIPAA. In fact, a university was fined nearly 3 million dollars by the Office for Civil Rights (OCR). The OCR discovered that the BA and the college never signed a BAA after a breach of student health data.

 

Storing PHI Compliantly

While choosing the right cloud service provider can be extensive, it will significantly benefit your practice. 

In fact, 83 percent of small healthcare practices surveyed named cloud-based EHR implementations the most meaningful business decisions they had made in the last few years. 

By doing your due diligence, working alongside your IT team, completing a BAA, and continuing to ensure the proper safeguards are in place, your patients’ PHI can be stored safely in the cloud. 

As your practice adopts more innovative data management methods, your HIPAA compliance should keep pace. With the right compliance software, your practice can easily streamline requirements like the BAA. 

Meet with an expert today to learn more about HIPAA compliance in your practice.

RECENT POSTS

Related posts

HIPAA Access Logs
Abyde News, Best Practices, HIPAA

Who’s Looking at Patient Records? Access Logs Tell All

September 15, 2025 No comments yet

September 15, 2025 In your practice, everyone plays an important role.  From receptionists handling schedules to doctors delivering care, ensure every team member knows their role and is empowered to act on it. Role-based privileges, which dictate who has access to what information, are also part of assigning roles in your practice. For example, while your receptionist might have access to a patient’s contact information to confirm an appointment, a doctor would have access to X-rays to assist in treatment plans.  Without clear boundaries, your practice risks HIPAA violations. For example, it’s a major compliance breach if Beth from accounting looks at a patient’s sensitive health records.  That’s where access logs come into play.  HIPAA Access logs are key to ensuring that Protected Health Information (PHI) is kept secure.    What is an HIPAA Access Log? As the name suggests, HIPAA access logs account for who, when, and for how long a staff member is utilizing a specific software. Your EHR or EMR will keep a running log when staff access information. Your practice must maintain access logs for six years.  That’s why it’s so essential for every staff member to have an individual login when using your practice’s systems.  Your practice’s HIPAA Compliance Officer (HCO) must routinely monitor access to PHI. Staff must know their responsibilities and the consequences of exploiting access to health records.  The OCR takes these exposures very seriously. Earlier this year, a health organization was fined $800,000 due to unauthorized access to health records. The number of exposed patients? One. The patient became aware of this breach and reported the organization to the OCR.  An access log is imperative for monitoring unauthorized third-party access, such as hackers, in addition to ensuring staff follow their role-based responsibilities.  Healthcare records can often be compromised, and no one realizes it until it’s too late.  Cyberattacks happen to organizations of all sizes.  In fact, after the multi-billion-dollar breach, investigators found that hackers had infiltrated Change Healthcare’s systems and gone undetected for over a week.   Stay Logged In  Clear roles and HIPAA access logs aren’t just paperwork; they’re vital for the success of your practice.  Your practice must train and empower staff on their responsibilities and investigate when things seem fishy. It only takes one slip-up, even just one patient’s records, to be exposed by impermissible access and caught in the OCR’s crosshairs.  With the right software solution, your practice can streamline training, documentation, and logs within a centralized compliance hub. Smart software gives your team the tools to succeed and makes compliance completely doable. Meet with an expert today to learn more about simplifying HIPAA compliance for your practice. 

Email Safety in Healthcare
Abyde News, Best Practices, HIPAA

One Click Away from a Breach: Protecting your Practice from Phishing Emails

August 28, 2025 No comments yet

August 28, 2025   We’ve all received an email that’s a little too good to be true.  Maybe it’s a “Congratulations, you’ve won a free vacation!” message, or a heartfelt request from an “international prince” who just needs your bank details. While these examples may sound obvious, phishing emails today are far more convincing, using logos, sender names, and even tone that mirror trusted organizations. However, healthcare staff have an even bigger target on their backs due to the sensitive nature of Protected Health Information (PHI). Healthcare staff, from the office manager to the doctor, are close to patients’ Social Security Numbers, billing information, and more, all of which are a goldmine for a malicious actor.  In light of the most recent $170,000 phishing HIPAA fine, it’s essential to review the best tips for keeping your email and patient data secure.    Email Safety 101 When hackers send 3.4 billion phishing emails daily, it’s essential to remain vigilant when reviewing emails. One mistaken click can jeopardize thousands of health records, so always carefully read your emails.  While your spam filter might hide some risky emails, phishing has become more advanced, including spoofing staff members and, in general, looking legitimate upon first glance.  First, when receiving an email, always think before you click. Does the email look suspicious? Is the grammar odd? Are there unnecessary attachments? Never download any attachments unless you are sure of the sender. A hacker could expose your entire practice to ransomware with one unsafe attachment. All it takes is one click.  When receiving an email, always ensure the account looks authentic. A familiar name doesn’t always mean a safe email. Cybercriminals are betting on healthcare staff not knowing the difference between ‘yourboss@email.com’ and ‘y0urboss@email.com’. The internet also provides hackers access to public posts, so even if the profile photo might be of your boss, chances are it isn’t your boss sending you an email demanding personal information.  Watch for common red flags.  If an email feels unusual, pause before acting, especially with messages marked as “urgent.” Cybercriminals rely on panic to push quick clicks. For example, an email shouting “WARNING: Update your EHR immediately using this link” is likely a scam designed to trick you into handing over access.  Delete spam emails or forward them to your phishing IT team (if applicable, likely for larger organizations), and ensure your team is aware of any threats and trained to identify and handle them appropriately.    Keeping it Secure Phishing emails aren’t rare; they’re routine.  That’s why it’s critical to give your staff the tools they need to safeguard PHI. A strong compliance program goes beyond policies by providing hands-on email safety training, encouraging protections like multi-factor authentication, and connecting your practice with trusted IT resources. Meet with an expert today to learn more about HIPAA compliance and email safety.  

Business Associate Phishing Fine
Abyde News, Business Associates, Fines, HIPAA

Phished and Fined: A $175,000 HIPAA Lesson for Business Associates

August 26, 2025 No comments yet

August 26, 2025 When scrolling through your inbox, letting your guard down is easy. Maybe you click on that email that looks like it’s from your bank without hesitation, or are swayed by the unsolicited message for a random all-expenses-paid trip. Unfortunately, phishing emails are everywhere, and they target the healthcare industry due to the sensitive nature of Protected Health Information (PHI). BST & Co., CPAs, LLP, known as BST, is a victim of phishing scams. The New York accounting and consulting firm, which works with practices, received the latest HIPAA enforcement, with a $175,000 fine and a two-year Corrective Action Plan or close monitoring by the Office for Civil Rights (OCR). The OCR discovered, after the fallout of a phishing email, that the Business Associate (BA) had failed to complete a Security Risk Analysis (SRA). This is the 10th enforcement of the Risk Analysis Initiative since its introduction last year. An SRA is a requirement for all HIPAA-regulated entities to assess all potential vulnerabilities of any physical, technical, or administrative safeguard in their organization. By identifying any concerns before a breach occurs, organizations are able to better safeguard PHI, keeping both their business and patients safe. This fine reminds us that BAs are just as responsible for upholding HIPAA as traditional medical practices and that completing the SRA is paramount. What Happened? On December 4, 2019, malware entered BST’s network after a successful phishing attempt. From December 4 to December 7, 170,000 patients’ PHI was exposed. The OCR began its investigation after BST reported the breach in February 2020. The OCR discovered that BST had not completed a thorough SRA. With a thorough SRA, BST could have seen the vulnerabilities regarding emails, or even how they secured Covered Entities’ PHI, and either prevented this breach or minimized its impact. Compliant Business Associates Keep Patients Safe Even though BST wasn’t treating patients directly, as an accounting and consulting firm they still had access to a Covered Entity’s PHI. That’s a clear reminder of just how important it is to make sure your Business Associates (BAs) are fully compliant. When your BA follows a comprehensive HIPAA compliance program, your practice gains peace of mind and a stronger, more secure partnership. The right solution helps you stay ahead of your BA responsibilities, whether that’s generating and maintaining Business Associate Agreements, providing staff training with practical tips like email safety, or completing a Security Risk Analysis (SRA) to uncover hidden risks. Connect with our team of compliance experts today to learn more.

How does AI impact your practice? Join our next webinar to learn the latest.

REGISTER NOW
X

Are you ready for an audit? Use our new HIPAA Audit Checklist to get prepared.

DOWNLOAD NOW
X