Healthcare Backup

Having a backup of your patient Health Information (PHI) is an important part of being HIPAA compliant, but backup backup alone does not make you HIPAA compliant. NovaStor can help you understand the requirements for backup and data protection, but recommends that you speak to a HIPAA expert to learn what it takes to be fully compliant. The rules to being HIPAA compliant are not always clear and can be open to interpretation leaving your business vulnerable.

NovaStor recommends that you follow these best practices when it comes to proper protection of your PHI.

Basic guidelines for data protection under HIPAA

• PHI protection is NOT optional – All Covered Entities, including medical practices and BAs, must securely maintain retrievable exact copies of electronic protected health information.
• PHI must be recoverable – The key here is that you must be able to fully “restore” any loss of data.  Without the ability to restore, data protection is rather useless.
• PHI must have a copy stored offsite –  There is some flexibility here with regards to what “offsite” is, but you need to have a copy of your critical data in a separate location than your practice.
• PHI must be protected frequently –  In these days even losing a day’s worth of data would be considered significant.
• PHI must be encrypted – PHI needs to be encrypted while at rest and also during transmission to prevent outside access.  Make certain that the data is encrypted with an industry accepted encryption algorithm. AES is the industry standard.
• PHI recovery must be documented – HIPAA requires written procedures related to your PHI backup and recovery plan. Showing your intent and taking the time to document the protection of your PHI could protect you from penalties.
• PHI recovery must be tested – You must be able to demonstrate that you tested your ability to restore lost PHI.

If you have any questions, please set up an appointment to speak to a NovaStor compliance expert.

If even one of your customers is from the healthcare vertical and you are handling any of their Patient Health Information (PHI), you are exposed to risk. You are considered a Business Associate and share the same regulatory compliance requirements as your customer and will be penalized for non compliance or data breach. Typically your customer will require that you sign a BA Agreement with them. To be safe, if you don’t have a BA Agreement in place, you should make it clear to your customer that without one, you cannot be held liable for potential breaches or non-compliance. Also be careful as PHI extends beyond obvious sources and can be found in within other verticals that deal with this type of information. For example, education facilities that track immunization records of their students or local government that maintains PHI, like healthcare records for an inmate within their judiciary system.

PHI must be maintained for the life of the patient. Therefore, best practice is to keep all records indefinitely to be safe and avoid risk of potential penalty.