I'm trying to understand the implications of Google's announcement that its cloud services are now HIPAA compliant...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
under the new Omnibus Rule. Does that mean organizations can offload HIPAA-relevant data to Google and no longer have to worry about compliance?
Google announced that some of its cloud services -- including Google Apps Vault, Gmail, Google Calendar, Google Drive and Google Docs -- are now HIPAA-compliant and may be used by HIPAA covered entities and business associates for the storage, processing and transmission of electronic protected health information (ePHI). If a company intends to follow this route, there are a few things that it should keep in mind.
First, choosing a HIPAA-compliant service provider does not automatically make a company HIPAA compliant. Google's assertion is that their services may be used in a HIPAA-compliant environment. Enterprises still need to develop and implement their own HIPAA compliance program and ensure that all of their activities meet HIPAA requirements.
Second, if your company chooses to use Google services for ePHI, it must enter into a Business Associate Agreement (BAA) with Google. This is a HIPAA requirement and, if it's not done, the company will not be compliant with HIPAA. To enter into a BAA, submit a request to Google using an administrator account for a Google Apps for Business, Education or Government domain.
Finally, Google will only sign BAAs covering certain Google services. Either disable other services or ensure that they will not be used for ePHI. This is your organization's responsibility. The services covered by Google BAAs include the HIPAA-compliant Gmail, Google Calendar, Google Drive/Docs and Google Apps Vault.
Ask the author:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
For more advice on staying HIPAA-compliant in the cloud, see this article.
Dig Deeper on HIPAA
Related Q&A from Mike Chapple
Here are some important criteria for hiring a partner to review your information security program, with a focus on HIPAA and HITECH compliance.continue reading
New guidance from the PCI SSC includes some essential aspects of tokenization security and what merchants need to know about tokenization products.continue reading
HIPAA data breach reporting now uses an electronic Web portal, so what does this mean for covered entities? Expert Mike Chapple explains.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.