Since 1996, the Health Insurance Portability and Accountability Act (HIPAA) has required healthcare organizations, covered entities, and their related business associates to establish procedures and processes for protecting patient health data against unauthorized access.

This includes protecting patient health data that is stored on Hosted or Cloud Voice services – messaging, call and conference recordings, and voicemail.

The trouble is that many Cloud Voice services do not comply with HIPAA standards, leaving patient information at risk of being accessed without authorization, leaked, ransomed, stolen, and sold despite the best efforts of healthcare organizations to protect their internal IT systems.

HIPAA Compliance Evaluation Criteria for Cloud Voice Services

When choosing a Cloud Voice service, it is essential to evaluate service providers in terms of how closely they comply with HIPAA. Specifically, they must have in place a robust, multi-layer security framework consisting of numerous physical and technical safeguards – such as encryption for web conferencing sessions – re-enforced by stringent administrative policies.

At a minimum, the following selection criteria merit consideration before making a Cloud Voice service procurement decision:

• Network Security – A high-performance firewall system must be in place to restrict access to and from the network. Administrator access privileges within the firewall system must be unique to each user and must be accessible to security administration personnel. Vulnerability assessments should be performed on a quarterly basis to help identify the need for improved security settings.

• System Monitoring – Cloud Voice servers must be configured to log access related events including, but not limited to, account logon events, account management changes, and system events. In addition, an intrusion prevention system (IPS) must be in place to analyze the network devices and report on possible or actual network security breaches. The IPS should be configured to send email alert notifications to security operations personnel when certain network events are detected.

• Cloud Voice Data Backup –Automated backup and server management systems must be in place to perform full backups on a predefined schedule to protect patient data from catastrophic loss. If one data center fails, built-in redundancy to another data center at a different location must be available. The ability to access backup and replicated data must be restricted to authorized administrators.

• Incident Response –In the event of a security incident, documented reporting and escalation procedures must be in place. Upon identification, incidents must be assigned priority levels based on their severity. In the event that incidents cannot be resolved by the lower level support teams or within defined response times, escalation procedures must be defined to get the necessary personnel involved to resolve the issue.

• AuthenticationandAuthorization – The provider’s administrative logons, account management changes, and system events should be tracked, logged, and reviewed for anomalies. Administrative password controls should be robust to further reduce the risk of unauthorized access.

• Access Requests and Access Revocation – Controls must be in place to ensure that system access is restricted to those who require it based on a valid business need. The ability to create a new user or modify an existing user’s access must be limited to authorized personnel. In the event a user is terminated, that user’s access credentials must be removed and/or disabled upon departure from the organization.

• Capacity Planning –An enterprise monitoring application must be in place to watch system capacity levels and trends. IT personnel should be notified with onscreen alerts when predefined thresholds for various capacity and availably events have been met.

• Disaster Recovery –A disaster recovery plan must be in place to guide personnel in system recovery. Automated server backups should be performed on a daily basis. Tests of the disaster recovery plan and procedures must be performed at least annually to identify any performance gaps.

Request a HIPAA Compliance Verification from your Cloud Voice Provider

In determining conformance with the HIPAA safeguards, the Office for Civil Rights (OCR) in the Department of Health and Human Services uses a detailed list of established performance criteria across the areas of privacy, security, and breach. Healthcare providers, covered entities and related business associates are expected to have measures in place to address these criteria. It is good practice to arrange a routine assessment of your HIPAA safeguards to identify any gaps so corrective measures can be taken.

When it comes to HIPAA compliance and Cloud Voice Services, it is not enough to accept the word of vendors and service providers. There should be independent verification from a recognized evaluation firm specializing in HIPAA compliance, and their report should be made available to you from the vendor or service provider on request.

Jeff Nolte is President and CEO of CTS (formerly Chesapeake Telephone Systems), a leading Voice and IT services provider based in Millersville, Maryland. He may be reached at (800) 787-4848 or jnolte@ctsmd.us. Visit www.CTSmd.us.