Microsoft Azure for HIPAA and HITECH and the Business Associates Agreement: What You Should Know

Healthcare organizations in the United States must adhere to the guidance of both the HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act) for securing and protecting Electronic Protected Health Information (EPHI).  Whether you view it as a positive or negative, the Federal Government has left the requirements of IT Security in HIPAA purposely vague.  The overarching guideline is to employ best practices based on the size of your organization.

For healthcare organizations looking to leverage Microsoft Azure for healthcare data in the cloud, Microsoft has published implementation guidance for adhering to HIPAA and HITECH on Azure (available here).  The guidance defines items in scope as: cloud services (both web and worker roll), Virtual Machines, Storage, Virtual Networks, Traffic Manager, Web Sites, BizTalk Services, Media Services, Mobile Services, Service Bus, Multi-Factor Authentication, Azure Active Directory, SQL Database and any other features identified on the Azure Trust Center.

However, there are some important details that every organization must understand regarding Microsoft's HIPAA guidelines for Azure.

Read and understand the Business Associates Agreement

The guidelines include requirements for Microsoft to agree to sign a Business Associates Agreement (BAA).  A BAA is a common contract between a Healthcare Organization and a service provider with access to EPHI that transfers the risk in case of a breach to the service provider. 

In Microsoft's case, the implementation guide is clear that Microsoft will only sign a BAA ...