Because HIPAA was introduced decades ago, before the advent of technologies like cloud computing, it is not specific in most regards about which tools or technologies businesses need to implement. Instead, HIPAA imposes high-level requirements, and leaves it to technology experts \u2013 like MSPs \u2013 to interpret them in the context of present-day tools and processes.
\nWhy HIPAA Matters for MSPs<\/p>\n
HIPAA imposes privacy and security requirements on any business that collects, stores, manages or otherwise interacts with medical information. Companies that are subject to HIPAA requirements are known as \u201ccovered entities,\u201d in the jargon of the law.<\/p>\n
Thus, it\u2019s not just healthcare businesses that need to comply with HIPAA. Any entity that handles medical data in any way \u2013 including MSPs who offer backup and recovery services to healthcare companies or their vendors or partners \u2013 may also need to be HIPAA-compliant.<\/p>\n
![\"CTA\"](\"https:\/\/no-cache.hubspot.com\/cta\/default\/5442029\/d7a3df42-5072-4766-aac8-e2bc23caa204.png\")
<\/a><\/span><\/span>\n<\/div>\n![\"WP](\"https:\/\/www.msp360.com\/resources\/wp-content\/uploads\/2019\/12\/Backup-best-practices-icon-2.png\"){kind=icon}
<\/div>\n<\/div>\nHIPAA Backup Requirements<\/h2>\n
If your role as an MSP is to back up or recover data that includes medical information, there are several specific HIPAA requirements you\u2019ll need to follow to a tee:<\/p>\n
- \n
- Establish a backup plan<\/strong>: HIPAA requires covered entities to have a backup plan in place that enables them to \u201cmaintain retrievable exact copies of electronic protected health information.\u201d MSPs must therefore ensure that any healthcare data they back up is an exact copy of the original information, and that it can be recovered to match its original state.<\/li>\n
- Establish a recovery plan<\/strong>: Backing up data is not enough. HIPAA also requires covered entities \u2013 or the MSPs who manage their backup operations \u2013 to develop a specific data recovery plan for recovering protected data whenever needed.<\/li>\n
- Backup testing<\/strong><\/a>: MSPs who back up medical data must also establish a backup testing plan so that they can perform \u201cperiodic testing and revision of contingency plans,\u201d according to the text of the HIPAA law.<\/li>\n
- Backup encryption<\/strong><\/a>: HIPAA requires that medical information, including but not limited to data backups, be secured using encryption.<\/li>\n
- Backup network security<\/strong>: Finally, MSPs that deal with healthcare data must implement \u201ctechnical security measures to guard against unauthorized access to electronic health information that is being transmitted over an electronic communications network.\u201d HIPAA isn\u2019t specific about what these network security measures include, but common protections would include tools like firewalls and monitoring the network for security threats.<\/li>\n<\/ul>\n
For MSPs who deal with protected medical information, then, it\u2019s critical not just to back up data, but also to implement and test a recovery plan. Equally important is ensuring that backup data remains secure in storage, as well as when it is being transferred over the network.<\/p>\n
How MSP360 Backup Can Help with HIPAA Compliance<\/h2>\n
MSP360 Backup makes it easy for MSPs to meet HIPAA compliance mandates, no matter which types of data they are backing up or which recovery mandates requirements they face.<\/p>\n
MSP360 provides a variety of backup options<\/a> \u2013 full backup, incremental backup<\/a> and so on \u2013 which help MSPs meet HIPAA\u2019s requirements to perform complete and accurate backups in an efficient way. In addition, MSP360 offers a number of security features<\/a> for protecting data at rest and in transit.<\/p>\n
With MSP360 Backup, MSPs can manage HIPAA-compliant backup and recovery operations without having to set up additional tools or processes. HIPAA compliance is built into the platform.<\/p>\n","protected":false},"excerpt":{"rendered":"
If you\u2019re an MSP who provides backup and recovery services, and any of the data you back up could contain medical information, HIPAA is a law you need to know. Although at first glance HIPAA may not seem to have major ramifications for data backup, it actually includes extensive provisions that regulate how data is […]<\/p>\n","protected":false},"author":94,"featured_media":54148,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[883,877],"tags":[],"class_list":["post-54146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-backup-and-dr-articles","category-blog-articles"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/54146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/users\/94"}],"replies":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/comments?post=54146"}],"version-history":[{"count":9,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/54146\/revisions"}],"predecessor-version":[{"id":57445,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/posts\/54146\/revisions\/57445"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media\/54148"}],"wp:attachment":[{"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/media?parent=54146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/categories?post=54146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.msp360.com\/resources\/wp-json\/wp\/v2\/tags?post=54146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Establish a recovery plan<\/strong>: Backing up data is not enough. HIPAA also requires covered entities \u2013 or the MSPs who manage their backup operations \u2013 to develop a specific data recovery plan for recovering protected data whenever needed.<\/li>\n