The Future of HIPAA in the Cloud
Frank A. Pasquale III
University of Maryland Francis King Carey School of Law; Yale University - Yale Information Society Project
Tara Adams Ragone
Seton Hall University School of Law, Center for Health & Pharmaceutical Law & Policy
June 30, 2013
Seton Hall Public Law Research Paper No. 2298158
U of Maryland Legal Studies Research Paper No. 2013-43
This white paper examines how cloud computing generates new privacy challenges for both healthcare providers and patients, and how American health privacy laws may be interpreted or amended to address these challenges. Given the current implementation of Meaningful Use rules for health information technology and the Omnibus HIPAA Rule in health care generally, the stage is now set for a distinctive law of “health information” to emerge. HIPAA has come of age of late, with more aggressive enforcement efforts targeting wayward healthcare providers and entities. Nevertheless, more needs to be done to assure that health privacy and all the values it is meant to protect are actually vindicated in an era of ever faster and more pervasive data transfer and analysis.
After describing how cloud computing is now used in healthcare, this white paper examines nascent and emerging cloud applications. Current regulation addresses many of these scenarios, but also leaves some important decision points ahead. Business associate agreements between cloud service providers and covered entities will need to address new risks. To meaningfully consent to new uses of protected health information, patients will need access to more sophisticated and granular methods of monitoring data collection, analysis, and use. Policymakers should be concerned not only about medical records, but also about medical reputations used to deny opportunities. In order to implement these and other recommendations, more funding for technical assistance for health privacy regulators is essential.
Number of Pages in PDF File: 56
Keywords: HIPAA, Omnibus HIPAA Rule, Cloud, Cloud computing, privacy, health privacy, health privacy laws, health information technology, health information law, HIPAA enforcement, health privacy regulation, covered entities, business associates, HIPAA subcontractors, HIPAA agency, medical reputations
Date posted: July 25, 2013