HIPAA and the HITECH Act
The Health Insurance Portability and Accountability Act (HIPAA) is a US healthcare law that establishes requirements for the use, disclosure, and safeguarding of individually identifiable health information. It applies to covered entities—doctors’ offices, hospitals, health insurers, and other healthcare companies—with access to patients’ protected health information (PHI), as well as to business associates, such as cloud service and IT providers, that process PHI on their behalf. (Most covered entities do not carry out functions such as claims or data processing on their own; they rely on business associates to do so.)
The law regulates the use and dissemination of PHI in four general areas:
- Privacy, which covers patient confidentiality.
- Security, which deals with the protection of information, including physical, technological, and administrative safeguards.
- Identifiers, which are the types of information that cannot be released if collected for research purposes.
- Codes for electronic transmission of data in healthcare-related transactions, including eligibility and insurance claims and payments.
The scope of HIPAA was extended with the enactment of the Health Information Technology for Economic and Clinical Health (HITECH) Act. Together, HIPAA and HITECH Act rules include:
- The HIPAA Privacy Rule, which focuses on the right of individuals to control the use of their personal information, and covers the confidentiality of PHI, limiting its use and disclosure.
- The HIPAA Security Rule, which sets the standards for administrative, technical, and physical safeguards to protect electronic PHI from unauthorized access, use, and disclosure. It also includes such organizational requirements as Business Associate Agreements (BAAs).
- The HITECH Breach Notification Final Rule, which requires giving notice to individuals and the government when a breach of unsecured PHI occurs.
HIPAA regulations require that covered entities and their business associates—in this case, Microsoft when it provides services, including cloud services, to covered entities—enter into contracts to ensure that those business associates will adequately protect PHI. These contracts, or BAAs, clarify and limit how the business associate can handle PHI, and set forth each party’s adherence to the security and privacy provisions set forth in HIPAA and the HITECH Act. Once a BAA is in place, Microsoft customers—covered entities—can use its services to process and store PHI.
Currently there is no official certification for HIPAA or HITECH Act compliance. However, those Microsoft services covered under the BAA have undergone audits conducted by accredited independent auditors for the Microsoft ISO/IEC 27001 certification.
Microsoft enterprise cloud services are also covered by FedRAMP assessments. Microsoft Azure and Microsoft Azure Government received a Provisional Authority to Operate from the FedRAMP Joint Authorization Board; Microsoft Dynamics 365 U.S. Government received an Agency Authority to Operate from the US Department of Housing and Urban Development, as did Microsoft Office 365 U.S. Government from the US Department of Health and Human Services.
Frequently asked questions
Microsoft offers qualified companies or their suppliers a BAA that covers in-scope Microsoft services.
For Microsoft cloud services: The HIPAA Business Associate Agreement is available via the Online Services Terms by default to all customers who are covered entities or business associates under HIPAA. See “Microsoft in-scope cloud services” on this webpage for the list of cloud services covered by this BAA.
For Microsoft Commercial Support services: The HIPAA Business Associate Amendment is available for in-scope Microsoft Commercial Support services upon request to your Microsoft services representative.
No. By offering a BAA, Microsoft helps support your HIPAA compliance, but using Microsoft services does not on its own achieve it. Your organization is responsible for ensuring that you have an adequate compliance program and internal processes in place, and that your particular use of Microsoft services aligns with HIPAA and the HITECH Act.
Microsoft cannot modify the HIPAA BAA, because Microsoft services are consistent for all customers and so must follow the same procedures for everyone. However, to create the BAA for Microsoft’s HIPAA-regulated customers and its services, Microsoft collaborated with some of the leading US medical schools and their HIPAA privacy counsel, as well as other public- and private-sector HIPAA-covered entities.
The Service Trust Portal provides independently audited compliance reports. You can use the portal to request audit reports so that your auditors can compare Microsoft's cloud services results with your own legal and regulatory requirements.
To assist customers with this task, Microsoft has published these guides:
- HIPAA/HITECH Act implementation guidance for Azure and for Dynamics 365 and Office 365. Written for privacy, security, and compliance officers and others responsible for HIPAA and HITECH Act implementation, they describe concrete steps your organization can take to maintain compliance.
- Practical guide to designing secure health solutions using Microsoft Azure helps you better understand what it takes to successfully adopt a cloud service in a secure manner.
- Addressing HIPAA security and privacy requirements in the Microsoft Cloud offers a brief overview of regulation requirements. It also provides a detailed analysis of how Microsoft’s cloud services were built with methodologies that map to those requirements, and guidance on how to build compliance-ready solutions.
Microsoft in-scope services
Covered services include:
API Management, App Service (API Apps, Logic Apps, Mobile Apps, and Web Apps), Application Gateway, Application Insights, Automation, Azure Active Directory (Free and Basic), Azure Active Directory B2C, Azure Active Directory Domain Services, Azure Advisor, Azure Analysis Services, Azure Bot Service, Azure Container Registry, Azure Container Service, Azure Cosmos DB, Azure Database for MySQL, Azure Database for PostgreSQL, Azure DevTest Labs, Azure DNS, Azure Information Protection (including Azure Rights Management), Azure Portal, Azure Resource Manager, Azure Search, Backup, Batch, BizTalk Services, Cloud Services, Custom Speech Service, Data Catalog, Data Factory, Data Lake Analytics, Data Lake Store, Event Hubs, ExpressRoute, Functions, HDInsight, Import/Export, IoT Hub, Key Vault, Language Understanding Intelligence Service, Load Balancer, Log Analytics, Machine Learning, Media Services, Microsoft Genomics, Multi-Factor Authentication, Notification Hubs, Power BI Embedded, Redis Cache, Scheduler, Security Center, Service Bus, Service Fabric, Site Recovery, SQL Data Warehouse, SQL Database, SQL Server Stretch Database, Storage, StorSimple, Stream Analytics, Time Series Insights, Traffic Manager, Virtual Machine Scale Sets, Virtual Machines (Including SQL VM), Virtual Network, VPN Gateway, and supporting infrastructure and platform services
App Service: Web Apps, Application Gateway, Automation, Azure Active Directory*, Azure Analysis Services, Azure Government Portal, Azure Resource Manager, Backup, Batch, Cloud Services, Compute Resource Manager, Event Hubs, ExpressRoute, Key Vault, Load Balancer, Log Analytics, Media Services, Network Resource Provider, Notification Hubs, Power BI, Redis Cache, Scheduler, Service Bus, Site Recovery, SQL Database, Storage, Storage Resource Provider, StorSimple, Traffic Manager, Virtual Machines, Virtual Network, and VPN Gateway
*Note: The use of Azure Active Directory within Azure Government requires the use of components that are deployed outside of Azure Government on the Azure public cloud.
- Cloud App Security
- Microsoft Health Bot Service
- Microsoft Stream
- Commercial Support: Premier and on premises for Azure, Dynamics 365, Intune, and for medium business and enterprise customers of Office 365
- Dynamics 365 and Dynamics 365 U.S. Government detailed list
- Microsoft Flow cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
- Office 365, Office 365 U.S. Government, and Office 365 U.S. Government Defense detailed list
- PowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
- Power BI cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
- Visual Studio Team Services