With HIPAA shared responsibility in the cloud, the clinic and cloud provider each have security duties. The provider manages parts of the cloud service and its underlying infrastructure. The clinic remains responsible for how it selects, configures, and uses that service to handle patient information. Moving data to AWS, Azure, or Google Cloud does not, by itself, make a clinic’s systems compliant or shift the clinic’s obligations to the provider.
The exact division depends on the service and its configuration. A clinic should understand that division before storing electronic protected health information (ePHI) in the cloud, and should document who handles key safeguards and what happens if something goes wrong.
What the cloud provider handles, and what the clinic retains
Cloud providers describe security as a shared model. Their responsibilities generally relate to the cloud platform and the infrastructure they operate. Customer responsibilities generally include the data and the way services, accounts, and applications are configured. The boundary varies by service. AWS explains its model in its shared responsibility overview, and Microsoft describes how responsibilities vary across cloud service types in its Azure shared responsibility guidance.
For a clinic, the practical question is not simply, “Is the cloud secure?” It is, “Which party is accountable for each control in our specific setup?” Use a responsibility map as a starting point, then confirm it against the provider’s service terms, configuration, and business associate agreement (BAA).
- Provider-managed areas: The provider typically manages the physical facilities and some of the underlying cloud infrastructure. The precise scope depends on the service.
- Clinic-managed areas: The clinic typically controls who has user accounts, what permissions those accounts receive, how staff use the system, and how clinic devices connect to it.
- Shared or service-dependent areas: Encryption settings, application security, operating system and software maintenance, backups, monitoring, and recovery may be divided differently depending on whether the clinic uses IaaS, PaaS, or SaaS and how the service is configured.
This is a working framework, not a universal control list. Confirm each item with the provider and the team responsible for the clinic’s cloud environment.
A BAA is important, but it is not a compliance certificate
A BAA sets out important terms for a provider handling ePHI on behalf of a clinic, including agreed safeguards and how the parties work together. But signing a BAA does not establish that the clinic’s particular deployment is compliant. The clinic still needs to assess its own risks, configure services appropriately, manage user access, and follow its policies and procedures.
Before relying on a provider’s HIPAA-related commitments, confirm that the BAA covers the specific services the clinic will use. Do not assume every product, feature, or connected service is included. Google Cloud’s HIPAA compliance information describes its cloud offerings and related commitments; clinics should check the applicable terms for their own services and deployment.
Encryption deserves particular care. It can reduce risk, but it does not automatically settle whether a provider relationship requires a BAA or make a clinic’s environment compliant. Have the clinic’s privacy, security, or compliance lead review how the provider handles ePHI and whether the agreement and service scope fit the use case.
How responsibilities can change by service type
With infrastructure as a service (IaaS), the provider supplies foundational cloud resources, while the clinic or its IT team may have more responsibility for operating systems, applications, and configuration. With platform as a service (PaaS), the provider manages more of the underlying platform, but the clinic still manages its data, user access, and application settings. With software as a service (SaaS), the vendor manages much of the application and infrastructure, while the clinic remains responsible for how staff access and use it, the information they put into it, and the controls available to the clinic.
These are broad distinctions. A service’s actual division of duties can vary, so ask the provider for a clear explanation of what it manages and what remains yours. If cloud migration is being planned, Zevonix’s guide to planning a medical practice cloud migration can help frame the operational questions to address.
Clinic checklist before moving ePHI to the cloud
Before migration or a major change to a cloud environment, document the answers to practical questions such as these:
- Confirm the service and BAA scope. Identify each service that will create, receive, maintain, or transmit ePHI, then confirm it is covered by the applicable agreement.
- Map control ownership. Record who manages user access, encryption settings, application configuration, operating system and software updates, security monitoring, backups, and recovery. Mark any responsibility that is unclear and resolve it with the provider.
- Assess the clinic’s risks. Consider how ePHI flows between the cloud service, EHR or other applications, staff devices, medical devices, and locations. Document the risks and the steps the clinic will take to address them.
- Plan access and account management. Establish who approves accounts and permissions, how access is reviewed, and how access is removed when a person no longer needs it.
- Define backup and recovery expectations. Confirm what is backed up, who monitors the process, how restoration is handled, and how the clinic can continue essential operations during an outage. See the guidance on healthcare business continuity planning for related planning considerations.
- Document incident coordination. Agree on how the provider will alert the clinic to a security incident, what information and assistance it will provide, and who at the clinic will assess the event and coordinate any required response.
- Plan for service exit. Decide how the clinic will retrieve its data, move it to another system if needed, and confirm what happens to remaining ePHI when the service ends.
These steps are also useful when reviewing an existing cloud setup. A clear responsibility map can reveal gaps that are easy to miss when each party assumes the other is managing a control.
Who responds to a cloud security incident?
The provider and clinic should coordinate, but their roles are not interchangeable. The provider’s duties to alert and assist the clinic should be addressed in the BAA and related service terms. The clinic needs an internal process to assess the event, involve the appropriate privacy and security leads, preserve relevant information, and determine what response is required. Do not assume the provider will make every decision or notify everyone on the clinic’s behalf.
For a healthcare organization, an incident can also affect connected applications, staff workflows, and access to patient records. Make sure the response plan covers cloud systems as well as the clinic’s wider environment. Zevonix provides healthcare-focused cloud services powered by AWS, Azure, and Google Cloud, along with a free IT assessment to help organizations review their technology environment.
Frequently asked questions
Who is responsible for HIPAA compliance when a clinic stores patient data in the cloud?
Responsibility is shared, but the clinic retains responsibility for its own use of the service and its safeguards. The provider manages the parts of the service it operates, as defined by the service and agreement.
Does a cloud provider’s BAA make the clinic HIPAA compliant?
No. A BAA is an important agreement, but it does not prove that the clinic’s configuration, access controls, workflows, and risk management are appropriate.
Who manages encryption, user access, backups, and patches?
It depends on the service and configuration. Confirm the owner of each control in writing rather than assuming the provider or clinic handles it automatically.
Is a provider a business associate if it stores only encrypted patient data?
Do not assume encryption alone removes the need to evaluate the relationship or BAA. Review the service, data handling, and applicable terms with the clinic’s compliance lead or qualified counsel.
Who must report a cloud security incident involving patient data?
The provider should notify and assist the clinic as described in the applicable agreements. The clinic should lead its own assessment and coordinate any required response and notifications.
Make cloud responsibilities explicit
Cloud security works best when both sides understand their duties and the clinic can verify that important controls are covered. Before a migration or service change, confirm the BAA scope, map responsibilities, and document incident, backup, and exit plans. If your organization wants help reviewing its healthcare IT environment, learn about HIPAA compliance management support or request a free IT assessment from Zevonix.