IBM Cloud is a cloud computing platform that provides a wide range of cloud services to businesses and organizations. After analyzing their compliance documents, we determined that IBM Cloud offers their customers a HIPAA compliant service.
What is IBM Cloud?
IBM Cloud is a cloud computing platform for organizations of all sizes and industries seeking versatile cloud solutions. It caters to the needs of modern businesses looking to harness the power of the cloud. With a wide range of cloud services at its core, IBM Cloud offers the flexibility and scalability required for businesses aiming to enhance their digital capabilities. Whether it's Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS), IBM Cloud provides a suite of tools and resources for building, deploying, and managing applications and workloads.
See also: Is Carepatron HIPAA compliant?
IBM Cloud and business associate agreements
A business associate agreement (BAA) is a document that outlines the responsibilities of third-party vendors when handling protected health information (PHI). Any software or service that stores, processes, or transmits PHI on behalf of a healthcare entity is considered a business associate and should, therefore, sign a BAA. Given IBM Cloud's functionalities, such as its portfolio of HIPAA-ready services designed for securely handling healthcare data, it would likely be categorized as a business associate when used within healthcare settings.
Upon reviewing IBM Cloud's Compliance Guide, they explicitly state their willingness to sign a BAA with healthcare entities. Specifically, IBM Cloud mentions: "IBM Cloud has policies and procedures to help IBM comply with its HIPAA obligations as a business associate, including cases where IBM stores and transmits PHI. IBM's responsibility to the covered entity client is specified in the applicable Business Associate Agreement (BAA)."
IBM cloud and data security
- Access control: IBM Cloud enforces strict access controls, ensuring only authorized users can access sensitive data. It implements policies, procedures, and technical controls to assign unique credentials to each user and govern access to PHI.
- Authentication: IBM Cloud employs authentication processes to validate the identity of entities accessing PHI. This helps confirm that PHI has not been altered or destroyed in an unauthorized manner.
- Encryption: PHI is encrypted in transit and at rest to prevent unauthorized access or modification. Encryption and decryption capabilities are implemented to ensure the confidentiality and integrity of healthcare data.
- Audit controls: IBM Cloud logs and tracks attempted access to PHI, recording all actions taken with the data once accessed. This audit trail helps in monitoring and ensuring compliance with data access policies.
- Automatic session timeouts: Controls are in place to automatically log off active sessions after a specific period of inactivity, reducing the risk of unauthorized access when users are not actively using the system.
- Backup and restore: Adequate backup and restore mechanisms are implemented to ensure the availability and recoverability of PHI in case of system failures or disasters, allowing for timely access in emergencies.
- Integrity controls: IBM Cloud employs security measures to prevent unauthorized modifications of electronically transmitted ePHI. Regular system scans are performed to identify vulnerabilities and ensure the integrity of systems handling PHI.
- Physical security: Access to data center facilities where PHI is stored and processed is tightly controlled to prevent unauthorized physical access, tampering, and theft. Comprehensive physical security measures are in place to safeguard PHI.
Is IBM Cloud HIPAA compliant?
IBM Cloud demonstrates a commitment to data security through its multi-layered security infrastructure. Furthermore, their willingness to sign a BAA reinforces their compliance with HIPAA standards. Based on these factors, IBM Cloud is HIPAA compliant.
Kirsten Peremore
