HIPAA Policy Templates for Healthcare Cloud Computing Vendors
Your customers are demanding robust HIPAA compliance. These templates are built for SaaS and cloud vendors that store customer PHI, and they map to the security questionnaires your customers send.
Your cloud host’s HIPAA compliance does not cover you.
Cloud software vendors with a software-as-a-service business model that store customers’ protected health information are business associates under HIPAA. That includes companies operating electronic health records, revenue cycle, claim processing, online backup, or any other cloud-based service that maintains PHI.
Cloud vendors need policies for software development, change management, help desk operations, data encryption, and business associate contracting. These templates address all of them, and they spell out the shared security model: which responsibilities belong to the cloud host (AWS, Azure, GCP), to you, and to your customer.
Because they are built on the same standards HITRUST and SOC 2 audits use, they are also excellent preparation if you plan to pursue those certifications.
What you get.
Increase sales with the strong HIPAA compliance customers demand.
Improve your responses to customer audits and increase retention.
Meet the obligations in your business associate agreements.
Tailor policies to your business in Microsoft Word.
Reduce the risk of a damaging breach with documented best practices.
Avoid fines from HHS and state attorneys general.
Cloud vendors are directly regulated.
Since September 2013, business associates have been directly regulated under HIPAA. Random federal audits of business associates began in 2016, and the first HIPAA penalties against a business associate followed the same year. OCR can impose civil money penalties in four tiers based on culpability, from violations the organization did not know about to willful neglect that was never corrected. Amounts are adjusted for inflation each year, annual caps per violation type reach into the millions, and state attorneys general can bring their own actions. Written policies and procedures are one of the first things investigators ask to see.
What’s included.
Every policy is delivered in Microsoft Word, organized by audience so staff read only what applies to them.
Policies for all staff
- 1000Definitions for HIPAA Regulations and HIPAA Policies
- 1010Confidentiality and Security: General Rules
- 1020Minimum Necessary Policy
- 1030Confidentiality Safeguards (Oral and Written)
- 1050Computer Usage
- 1060Computing Devices and Workstations: Company-owned and BYOD
- 1070Employee Work at Home
- 1080Duty to Report Violations and Security Incidents
Policies for administrative management
- 1500Employee/Contractor Recruiting and Termination
- 1600Disclosures Required by Law
Policies for technical staff
- 2000Technical Support Procedures
- 2010Software Development Procedures
- 2020Source Code Management
- 2030Intellectual Property
- 2040Authentication, Passwords and Encryption Keys
Executive management and Security Officer
- 2900HIPAA Officer Appointment and HIPAA Documentation
- 3000Security Management Process
- 3005Data Backup
- 3010Disaster Recovery and Emergency Mode Operation Plans
- 3015Facility Security and Access Control
- 3020Periodic Security Evaluation and/or Third-Party Audits
- 3025Audit Control and Activity Review
- 3030Malicious Software Protection
- 3033Change Management
- 3035Breach Reporting
- 3040HIPAA Policy and Security Awareness Program
- 3050Device and Media Disposal and Re-Use
- 3060Technical Safeguards
- 3062Technical Controls for Mobile Devices
- 3070Business Associate Agreements and Vendor Management
- 3075Employee System Access
- 3080Employee Sanctions
- 3090Security Incident Response and Reporting
- 3095Supporting Patients with their HIPAA Rights
Appendices and forms
- Appendix A: Identifying Business Associates
- Appendix B: Sample HIPAA BAA for Use with Subcontractors
- Appendix B2: Sample HIPAA BAA for Use with Customers
- Appendix C: Facility Security and Access Plan
- Appendix D: Workforce Access to PHI and Safeguards
- Appendix E: Miscellaneous
- Appendix F: Disaster Recovery Plan
- Healthcare Cloud Vendor Disclosure Log
- Employee-Owned Device Agreement
- Company-Owned Device Agreement
Gary Pritts, Founder and President
Gary Pritts is Founder and President of Eagle Consulting Partners. He began his HIPAA work providing technical input during the federal government's original drafting of the HIPAA regulations, and has since served more than 1,000 organizations as a consultant, as well as serving as a hospital trustee and as CSO for a cloud healthcare messaging company. Gary studied computer science at Purdue University and holds an MBA from Harvard Business School.
Gary’s time as CSO of a cloud healthcare messaging company gives these templates a practical understanding of how SaaS vendors build, operate, and support software that handles PHI.
HIPAA Policy Templates for Healthcare Cloud Computing Vendors
Instant download in Microsoft Word. Perpetual license for a single organization. Satisfaction guaranteed.
Save 20% ($100) with code Save-20 at checkout
Need policies built around your organization?
Eagle can tailor any template to your risk assessment, or write custom policies from the ground up. Call us, or send a note and we will follow up.
Talk to Eagle