In October, the U.S. Department of Health and Human Services ("HHS") published guidance explaining obligations for covered entities and business associates when using cloud services providers under the Health Insurance Portability and Accountability Act ("HIPAA"). Under the guidance, when covered entities and business associates use cloud services, they must enter into an additional business associate agreement with the cloud services provider. Covered entities must also ensure that any service-level agreements in place with cloud service providers are consistent with the business associate agreements and applicable HIPAA rules.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
