Before agreeing to trust another business with your data, there are several precautions you need to take. Firstly, make sure you have audited a Business Associate or Subcontractor’s HIPAA compliance program before signing a Business Associate Agreement (BAA) with them, and do so again each year before you resign the agreement.

Many large tech providers have pre-written BAAs that say they only cover “in-scope services” or that it is your responsibility to appropriately configure their product to be fully HIPAA compliant. Google, Microsoft, and Dropbox, three of the largest providers of business technology solutions, fall into this camp.

So, what are considered “in-scope services”? And what do you need to do to properly configure your systems so your data is secure and you’re HIPAA compliant? Here’s an overview of the processes for making your environment HIPAA compliant when using services provided by these three vendors.

Microsoft

Whether your organization is considered a Covered Entity or Business Associate under HIPAA, Microsoft “offers qualified companies or their suppliers a BAA that covers in-scope Microsoft services.”¹

The following are considered in-scope cloud platforms & services:

• Azure and Azure Government
• Azure DevOps Services
• Dynamics 365 and Dynamics 365 U.S. Government
• Intune
• Microsoft Cloud App Security
• Microsoft Cloud for Healthcare
• Microsoft Healthcare Bot Service
• Microsoft Managed Desktop
• Microsoft Professional Services: Premier and On Premises for Azure, Dynamics 365, Intune, and for medium business and enterprise customers of Microsoft 365 for business
• Office 365, Office 365 U.S. Government
• Power Automate (formerly Microsoft Flow) cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• PowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
• Power BI cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite

For those using the company’s in-scope services, Microsoft offers a downloadable BAA, in the form of a non-editable Word document, which you can save for your records. 

Microsoft also provides a HIPAA and HITECH implementation guide for Microsoft Office 365 and Microsoft Dynamics CRM. The guide makes it clear that Microsoft’s services are only HIPAA compliant under certain conditions, and it cannot be held responsible if you do not make the proper configurations.² 

These configurations may include:

• Designating certain personnel as Privacy Readers in your Microsoft 365 Message Center, which will allow them to be notified of any suspected breaches of PHI
• Setting access controls
• Making consistent, comprehensive backups of data
• Using cybersecurity best practices and training employees on account security³ 

It is the responsibility of you and your employees to determine which Microsoft services can be configured in a manner which is HIPAA compliant, and how you will implement rules and safeguards to ensure users manage these services in a way that complies with HIPAA requirements.

Microsoft does not guarantee that all PHI transmitted or stored using its services will be protected. It is up to you to protect your data via good security practices and proper configurations.

Google

The new Google Workspace, an updated version of G Suite, is an integrated collection of applications including Gmail, Google Calendar, Google Meet, Google Drive, Google Docs, and more. Some of these applications can be made HIPAA compliant if configured correctly.

To help you in this endeavor, Google published a G Suite and Cloud Identity HIPAA Implementation Guide, which still holds true when it comes to configuring Google Workspace, as many of the applications are still the same.⁴ 

The guide states that PHI should only be allowed on the applications identified as “Included Functionality” in the BAA your company obtains with Google. Furthermore, Administrators should limit which services or applications are available to different groups of end users. 

Google’s guide contains detailed descriptions of each application’s security features, which should be turned on, monitored by Administrators, or included in employee training so that each user knows how to store and transmit PHI in a secure manner.

Other safeguards you might implement in order to make Google applications HIPAA compliant are:

• Implementing access controls
• Enabling two-factor authentication
• Turning off link-sharing and file-syncing
• Restricting file-sharing outside the domain
• Using unique passwords
• Setting document visibility to private
• Disabling offline storage, third-party app, and add-ons
• Regularly auditing account logs, access, and shared file reports
• Ensuring that ‘manage alerts’ setting is turned on to notify administrators of changes to settings
• Using the 3-2-1 backup rule⁵

Dropbox

Dropbox is one of the most popular cloud storage services, frequently used to share files between users and easily access files on mobile. 

The company has published a cybersecurity guide entitled “Shared responsibility: Working together to keep your data secure.” This is split into two sections: “Dropbox’s responsibilities” and “Customer responsibilities.” 

The best practices customers should follow include reviewing Dropbox’s practices, Terms of Service, and other agreements, configuring sharing and viewing permissions for maximum security and productivity, strengthening authentication procedures, and conducting regular access reviews.⁶

Dropbox also has a Getting started with HIPAA guide businesses can consult for tips on how to manage your security infrastructure, including:

• Configuring sharing permissions
• Disabling permanent deletions
• Monitoring account access and activity
• Understanding the role of third party apps⁷

Conclusion

Signing a BAA with a Business Associate or Subcontractor is a much more involved process than just collecting signatures. Continuing to take a proactive stance even after you sign can help you protect your business and data in the event of a breach. Consult any guides the service may have published on HIPAA compliance, and talk to your IT team about how best to configure applications to achieve maximum data protection.

Have you performed a Risk Assessment in the past year? Do you have updated HIPAA Policies and Procedures in place? Our HIPAA Prime™ program does all this and more! We create customized compliance documents and provide your staff with easy online training, ensuring compliance for your business.

Want to know more about how you can become HIPAA compliant?

Email us at info@totalhipaa.com to learn more about how we can help your organization become (and stay!) HIPAA compliant. Or, get started here.

1. Frequently asked questions
2. HIPAA/HITECH Act Customer Considerations for Microsoft Office 365 and Microsoft Dynamics CRM Online
3. Is Microsoft 365 HIPAA Compliant?
4. G Suite and Cloud Identity HIPAA Implementation Guide
5. Is Google Drive HIPAA Compliant?
6. Shared responsibility: Working together to keep your data secure
7. Getting started with HIPAA

Sharing is caring!