Dropsuite Logo

HIPAA Compliance for Data Protection

Comply with HIPAA regulations using secure email backup.

HIPAA Compliance for Data Privacy and Security

HIPAA (Health Insurance Portability and Accountability Act of 1996) is a set of regulations protecting the privacy and security of certain health information. There are two parts to HIPAA that impact any firm collecting, transferring, storing or using PHI (Protected Health Information). Those parts are:

Privacy Rule – set of privacy standards to protection PHI
Security Rule – set of security standards to protect PHI

The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, are a set of national standards for the protection of certain health information.

The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) are a set of security standards for protecting certain health information that is held or transferred in electronic form. The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “electronic protected health information” (e-PHI).


GDPR Compliance for Data Privacy and Security

The GDPR regulations went into effect May 25, 2018 and are actually a series of changes to the original EU regulations published in 1995. There are three major changes to the privacy and information access laws in GDPR that increase the scope and accountability for protecting EU citizen privacy online. Those parts are:

  • Increased Territorial Scope
  • Penalties
  • Consent

The biggest change to the regulatory landscape of data privacy comes with the increased territorial scope of the GDPR, as it now applies to all companies processing the personal data of data subjects residing in the European Union, regardless of the company’s location.

The penalties have also greatly increased. Under GDPR organizations in breach of GDPR can be fined up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher. This is the maximum fine that can be imposed for the most serious infringements e.g. not having sufficient customer consent to process data or violating the core of Privacy by Design concepts.

The conditions for consent have been strengthened, and companies will no longer be able to use long illegible terms and conditions full of legalese, as the request for consent must be given in an intelligible and easily accessible form, with the purpose for data processing attached to that consent. Consent must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it.


HIPAA Standards Applying to Data Backup

For healthcare and related firms that use PHI, there are several parts of the HIPAA standards that apply to backup, archiving and recovery of email, website and related data.* When choosing a backup and restore solution, consider how well the solution meets the following regulations.

Information Access Management

A covered entity must implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient’s role (role-based access).

Workstation and Device Security

A covered entity must have policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of e-PHI.

Technical Access Control

A covered entity must implement technical policies and procedures that allow only authorized persons to access electronic protected health information (technical user-based access).

Audit Controls

A covered entity must implement hardware, software, and/or procedural mechanisms to record and examine access and other activity in information systems that contain or use e-PHI.

Integrity Controls

A covered entity must implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed and confirm that e-PHI has not been improperly altered or destroyed.

Transmission Security

A covered entity must implement technical security measures that guard against unauthorized access to e-PHI that is being transmitted over an electronic network.

Because of these regulations, health care firms must have the best available tools to help make their jobs easier. That’s what Dropsuite focuses on. We are proud to provide our customers with HIPAA compliant solutions for email, website and related data backup, archiving and recovery.

* Source: HHS.gov “Summary of the HIPAA Security Rule”

HIPAA Compliance Use Cases

Email Backup and Archiving

HIPAA regulatory compliance can be met with email backup and archiving. Email backup and archiving must provide the ability to setup role-based permissions to restrict access to only those that require it. This should also include the ability to provide 3rd party auditor access for those who may need to verify your PHI is unaltered and unchanged. Email archiving provides the ability to conduct audits along with securing your email data in the original unaltered state. Using a secure cloud-based solution with military-grade encryption further ensures data is protected and safe.

Website Backup and Restore

HIPAA regulatory compliance can also be met with website backup and restore. Any PHI data entered into or through the website should be secured, backed up and protected. Easy to setup and administer role-based access is a must-have. Secure military-grade encryption is essential to ensure the privacy and security of the data. Should a website data disaster happen, such as a ransomware attack or file corruption, the ability to quickly restore data with 1-Click restore is essential to quickly recovering the business.

HIPAA Compliance and Data Protection

Dropsuite provides HIPAA compliant email backup and archiving specifically designed provide continuous availability of email communications in the cloud. Our solution includes easy-to-use, secure and scalable tools to manage them, especially for firms using cloud-based solutions like O365 and others.

Dropsuite also provides HIPAA compliant website backup and restore specifically designed to beat all above needs. In addition, we ensure your website is always available and fully protected with automated backups and 1-Click restore in case of any data disaster.

Dropsuite Backup and Archiving Features for HIPAA Compliance

  • HIPAA compliant
  • eDiscovery
  • Journaling
  • Tamper-proof audit trail
  • Advanced search
  • Legal hold
  • Set retention periods
  • Secure 3rd party access
  • Permission level management
  • Automated data backups (3X daily)
  • Website backup
  • Office 365 backup
  • SharePoint backup
  • OneDrive backup
  • Groups backup
  • Teams backup
  • Email backup (Exchange Online, G Suite Gmail, IMAP or POP)
  • 1-Click data restore
  • Insights email intelligence tool
  • Unlimited storage & retention

HIPAA Protection in the Cloud

Complying with HIPAA means it’s critical to protect your data from ransomware, accidental deletion, employee sabotage, and data breeches. These can all cause your email or website communications to become blocked, damaged or stolen – which can cause risk of a HIPAA violation. Dropsuite safeguards firms for HIPAA compliance while also providing protection from all types of unexpected data loss.

An email or website backup solution assures that your records are systematically stored in a central cloud data repository with state-of-the-art security and legal hold features in place to guard against issues of tampering. Dropsuite was tailored-made for the rigid security requirements that HIPAA regulations demand from a cloud partner.

“Our customers have expressed high satisfaction in having a simple dashboard they can manage the Dropsuite service.”
Robert Nad's Dropsuite Testimonial
Robert Nad
GM of Operations OzHosting.com

Experience a Live 15 Minute Demo

See how you can backup data for your business defense