The Health Insurance Portability and Accountability Act (HIPAA) is a comprehensive law that protects individuals' health information while ensuring the continuity of health insurance coverage. It sets standards for privacy and security that must be followed by all entities that handle Protected Health Information (PHI), also known as electronic PHI (ePHI). HIPAA is specific to the United States, however many countries have similar or laws already in place or under legislation.
Under HIPAA, both covered entities and business associates have distinct responsibilities to ensure the protection of PHI. Zuvo acts as a business associate for customers (the covered entity) who wish to provide healthcare related services. As a business associate, Zuvo has a number of obligations and has undergone auditing of the security and privacy controls that are in place to meet these. Zuvo has signed a Business Associate Agreement (BAA) with all of our vendors who would have access to ePHI, such as AWS, and ensure that we follow their terms listed in the agreements. Similarly when a customer signs a BAA with us, they have some responsibilities they agree to when using Zuvo to store PHI.
Customer responsibilities
Covered entities (the customer) are organizations that directly handle PHI, such as health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions.
- Compliance with HIPAA Rules: Covered entities must comply with the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule to protect the privacy and security of ePHI.
- Business Associate Agreements (BAAs): Customers must sign a BAA with Zuvo. When the covered entity engages a business associate to help carry out its healthcare activities, it must have a written BAA. This agreement outlines the business associate's responsibilities and requires them to comply with HIPAA Rules.
- Internal Compliance Programs: Customers must configure their HIPAA projects and follow the guidance given by the security advisor. Covered entities are responsible for implementing internal processes and compliance programs to ensure they meet HIPAA requirements.
Zuvo responsibilities
Zuvo as the business associate, and the vendors used by Zuvo, are the entities that perform functions or activities on behalf of the customer.
- Direct Liability: Zuvo is directly liable for compliance with certain provisions of the HIPAA Rules. This means Zuvo has to implement safeguards to protect ePHI and report breaches to the customer.
- Compliance with BAAs: Zuvo must comply with the terms of the BAA, which includes implementing appropriate administrative, physical, and technical safeguards to protect ePHI.
- Vendor Management: Zuvo must also ensure that our vendors, who may have access to ePHI, comply with HIPAA Rules. This is done through a BAA with each vendor.
Staying compliant and secure
Compliance is a continuous process and should not be treated as a point-in-time audit of controls. Zuvo applies all the necessary privacy and security controls to ensure HIPAA compliance at audit time, but also has additional checks and monitoring in place to ensure those controls are not disabled or altered in between audit periods. Customers commit to doing the same in their HIPAA environments. Zuvo provides a growing set of checks that warn customers of changes to their projects that disable or weaken HIPAA required controls. Customers will receive warnings and guidance via the Security Advisor, however the responsibility of applying the recommended controls falls directly to the customer.
Our shared responsibility model document discusses both HIPAA and general data management best practices, how this responsibility is shared between customers and Zuvo, and how to stay compliant.
Frequently asked questions
What is the difference between SOC 2 and HIPAA?
Both are frameworks for protecting sensitive data, however they serve two different purposes. They share many security and privacy controls and meeting the controls of one normally means being close to complying with the other.
The main differentiator comes down to purpose and scope.
- SOC 2 is not industry-specific and can be applied to any service organization that handles customer data.
- HIPAA is a federal regulation in the United States. HIPAA sets standards for the privacy and security of PHI/ePHI, ensuring that patient data is handled confidentially and securely.
Are Zuvo HIPAA environments also SOC 2 compliant?
Yes. Zuvo applies the same SOC 2 controls to all environments, with additional controls being applied to HIPAA environments.
Does Zuvo log database connections by default?
No. Zuvo sets Postgres log_connections to off by default for new projects. HIPAA and high-compliance projects should keep connection logging enabled. The Security Advisor warns if it is disabled.
How often is Zuvo audited?
Zuvo undergoes annual audits. The HIPAA controls are audited during the same audit period as the SOC 2 controls.