HIPAA

Overview

HIPAA-sized

A growing number of healthcare providers, payers, and IT professionals are using AWS's utility-based cloud services to procedure, shop, and transmit protected health data (PHI).

AWS enables covered entities and their business associates subject area to the U.S. Health Insurance Portability and Accountability Human action of 1996 (HIPAA) to use the secure AWS environment to process, maintain, and shop protected health data.

For detailed information about how you tin can use AWS for the processing and storage of wellness information, see the whitepaper Architecting for HIPAA Security and Compliance on Amazon Web Services.

AWS Healthcare and Life Sciences Customers

  • What are HIPAA & HITECH?

    The Wellness Insurance Portability and Accountability Act of 1996 (HIPAA) is legislation that is designed to brand information technology easier for US workers to retain health insurance coverage when they change or lose their jobs. The legislation also seeks to encourage electronic health records to ameliorate the efficiency and quality of the United states of america healthcare system through improved information sharing.

    Along with increasing the employ of electronic medical records, HIPAA includes provisions to protect the security and privacy of protected health information (PHI). PHI includes a very wide prepare of personally identifiable health and health-related data, including insurance and billing information, diagnosis information, clinical care information, and lab results such as images and test results. The HIPAA rules apply to covered entities, which include hospitals, medical services providers, employer sponsored health plans, research facilities, and insurance companies that bargain directly with patients and patient data. The HIPAA requirement to protect PHI also extends to business concern associates.

    Health Information technology for Economical and Clinical Health Act (HITECH) expanded the HIPAA rules in 2009. HIPAA and HITECH together plant a gear up of federal standards intended to protect the security and privacy of PHI. These provisions are included in what are known as the "Administrative Simplification" rules. HIPAA and HITECH impose requirements related to the use and disclosure of PHI, appropriate safeguards to protect PHI, private rights, and authoritative responsibilities.

    For more information nigh how HIPAA and HITECH protect health information, see the Health Information Privacy webpage from the US Department of Health and Human Services.

  • What is HITRUST?

    The Health Data Trust Alliance (HITRUST) Mutual Security Framework (CSF) in their own words, "is a certifiable framework that provides organizations with a comprehensive, flexible and efficient approach to regulatory compliance and risk management. Developed in collaboration with healthcare and information security professionals, the HITRUST CSF rationalizes healthcare-relevant regulations and standards into a single overarching security framework."

    The HITRUST CSF serves to unify security controls from federal law (such every bit HIPAA and HITECH), land police (such every bit Massachusetts'southward Standards for the Protection of Personal Information of Residents of the Commonwealth ), and non-governmental frameworks (such equally the PCI Security Standards Council) into a single framework that is tailored for healthcare needs.

    AWS provides a reliable, scalable, and inexpensive calculating platform that can support healthcare customers' applications in a manner consistent with HIPAA, HITECH, and HITRUST CSF.

  • What is a Business Associate Addendum?

    Under the HIPAA regulations, cloud service providers (CSPs) such as AWS are considered business associates. The Business Acquaintance Addendum (BAA) is an AWS contract that is required under HIPAA rules to ensure that AWS appropriately safeguards protected health information (PHI). The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI past AWS, based on the relationship betwixt AWS and our customers, and the activities or services being performed by AWS.

  • Will AWS sign a Business Associate Addendum as described in the HIPAA rules and regulations?

    Step-by-step: Larn how to employ AWS Artifact to accept agreements for multiple accounts in your org. (two:07)

    See how to apply AWS Antiquity to accept an agreement for your account. (1:39)

  • Is AWS HIPAA certified?

    In that location is no HIPAA certification for a deject service provider (CSP) such every bit AWS. In club to meet the HIPAA requirements applicative to our operating model, AWS aligns our HIPAA run a risk management plan with FedRAMP and NIST 800-53, which are higher security standards that map to the HIPAA Security Rule. NIST supports this alignment and has issued SP 800-66 An Introductory Resource Guide for Implementing the HIPAA Security Rule, which documents how NIST 800-53 aligns to the HIPAA Security Dominion.

  • What services tin I use in my AWS business relationship if I take a Concern Associate Addendum with AWS?

    Customers may utilise whatever AWS service in an account designated as a HIPAA account, but they should simply process, store, and transmit protected wellness information (PHI) in the HIPAA-eligible services defined in the Business organization Acquaintance Addendum (BAA). For the latest listing of HIPAA-eligible AWS services, see the HIPAA Eligible Services Reference webpage.

    AWS follows a standards-based take chances management program to ensure that the HIPAA-eligible services specifically support the security, control, and administrative processes required under HIPAA. Using these services to store and procedure PHI allows our customers and AWS to address the HIPAA requirements applicable to our utility-based operating model. AWS prioritizes and adds new eligible services based on customer demand.

    For more data most our business associate programme, or to asking new eligible services, please contact us.

  • I am an AWS SaaS partner with a BAA and I sell my SaaS solutions to healthcare providers or other covered entities. Do those covered entities besides need to sign a BAA with AWS?

    No. This is a very common scenario and many HIPAA solution partners run their Software as a Service (SaaS) offerings in AWS. You equally the AWS SaaS partner sign a Business Associate Addendum (BAA) with AWS. Then each healthcare provider or covered entity signs a BAA merely with you, the AWS SaaS partner. If the covered entity using your SaaS solutions is also a straight customer of AWS for HIPAA-related systems, then the covered entity may demand one BAA with you and some other BAA with AWS.

  • Does the AWS HIPAA compliance plan require me to utilize Amazon EC2 Dedicated Instances or Dedicated Hosts to process protected health information?

    AWS customers and Amazon Partner Network (APN) Partners who have signed a Business Associate Addendum (BAA) with AWS are not required to utilize Amazon Rubberband Compute Cloud (EC2) Dedicated Instances or Defended Hosts to process protected health information (PHI). Prior to May 15, 2017, the AWS HIPAA compliance plan required that customers who candy PHI using Amazon EC2 must use Defended Instances or Dedicated Hosts, but this requirement has been removed.

HIPAA Resource

compliance-contactus-icon

Have Questions? Connect with an AWS Business Representative