Microsoft Office 365 is a productivity suite of tools we all know and love. With the help of O365, all businesses – not just healthcare providers – have been able to transform the way they take on and complete administrative tasks, and this has benefited the business time and time again. So, it’s no wonder that O365 has become an essential aspect of almost every business.
In the healthcare industry, Office 365 has made a lot of difference. It has helped them to work more efficiently and streamline their business processes. Many healthcare providers use it for communication purposes, and it can also make collaboration among different departments easier. But the question remains: is Office 365 HIPAA compliant?
So, is it a ‘yes’ or a ‘no’?
It’s a yes! But as with everything these days, it’s not just a simple ‘yes’ whereby you can expect to install the suite and then wash your hands of any future HIPAA responsibility. So, listen up because here come the ins and outs of the situation.
The Ins and Outs
Office 365 is a HIPAA compliant product – but only with a signed business associate agreement (BAA) and correct product usage. The BAA is a standard requirement of HIPAA compliance, and Microsoft offers this by default to its subscription customers that are covered entities or business associates. A BAA must be obtained before Office 365 is used to share, store, or maintain protected health information (PHI). The use of Office 365, though, does not automatically make your business HIPAA compliant.
As a covered entity, you are required to check and correctly configure access controls, turn on administrative tracking features, and ensure that your staff are trained to use Office 365 correctly and in compliance with HIPAA standards.
Know how to use it
Making sure Office 365 is HIPAA compliant depends entirely on how you use the product, and there are a few things you should be aware of when ensuring your Office 365 software is HIPAA compliant. While Microsoft provides end-to-end encryption for stored and uploaded data to a server or data transmitted beyond its servers, it doesn’t provide encryption for everything. For instance, file names, email subject lines, and message headers are free from encryption, so employees must be made aware that these areas should not include PHI.
Know who has access
To comply with HIPAA, all organizations must also have a documented access management plan and be able to maintain a log of the employees’ activities. Access management requirements are vast and can include everything from restricting or monitoring the use of devices like smartphones and tablets, to ensuring that employees do not share sensitive information over unsecured networks. As part of Microsoft’s commitment to boosting tech security, it has implemented an auditing option for Office 365. This new feature gives users the ability to create logs that are available upon request. By limiting what can be seen, the auditing feature is meant to curb any potential risks.
Back up, back up, back up
One of the most crucial aspects of your business is the PHI that it generates, which is why HIPAA compliance requires comprehensive offsite backup protocols. Microsoft does what it can to ensure their services remain up and running, but, unfortunately, online services are always subjected to disruptions and outages. Microsoft is not responsible for data loss, so it is important that you have implemented regular offsite backups of content and data stored on Microsoft Services or third-party apps or services.
Get on board with 2FA
Two-factor authentication (2FA, multifactor authentication, or MFA) is a must. Microsoft’s BAA coverage is only enacted if 2FA is enabled. 2FA provides another layer of data protection by ensuring access is verified in multiple ways before access is granted.
HIPAA compliance is not as easy as you think
There are a lot of areas to consider when you’re on the road to HIPAA compliance. It’s complicated, but there are ways that you can make it less so, and Merit Technologies can help. As a HIPAA-verified managed service provider, Merit Technologies can help your organization achieve your HIPAA compliance goals, so get in touch with the team today.
