Privacy: Storing PHI Offsite? Refer to This Checklist to Stay Compliant

Why This Topic Matters

Moving PHI to offsite storage changes a practice’s privacy and security risk profile and can trigger specific contractual, operational, and oversight obligations. This article helps readers understand the broad compliance areas they should review before and after adopting cloud storage.

Article Sections

1. Evaluate the Vendor

   Introduces vendor-selection considerations for organizations handling regulated health information and cloud-based storage services.

2. Check Out the Data Protection

   Covers general storage-security topics such as encryption and separation of client data within a vendor environment.

3. Ensure Proper Breach Protocols

   Discusses breach monitoring, response planning, and how responsibilities may be divided between the practice and the vendor.

4. Develop a BAA

   Addresses business associate contracting, required compliance language, and vendor assurances tied to privacy and security obligations.

5. Monitor Compliance

   Describes ongoing oversight expectations and the broader compliance relationship between covered entities and business associates.

6. Update Your Policies & Procedures

   Focuses on internal policy and procedure updates needed to reflect online storage activities and related safeguards.

7. Audit Yourself

   Reviews self-audit, risk assessment, access-control, and documentation topics related to cloud-based PHI storage.