Your Healthcare Hosting Provider Says They’re Compliant, Can They Prove It?

In a recent Healthcare IT Today interview, Kelly Goolsby, Director of Solution Architecture at Nexcess, says that many clients come to them after trying another managed hosting provider who made impressive claims but failed to follow through on compliance, security, and other promises.

Claiming to be a “show me” kind of guy, Goolsby recommends that clients not rely on promises made by potential vendors, but ask for proof and transparency. Check the logs to make sure that the expected antivirus software and other security measures are present. Some hosting providers are now being punished for non-compliance with HIPAA and other regulations. Migration to a new hosting service can take six months, so clients should try to choose a reliable vendor at the start.

Goolsby also says that regular audits, while important, are not enough, especially when a client is rolling out a new service or source of data. An audit is a look at the past, and therefore comes too late to prevent security problems. Clients should do regular checks that anticipate security needs as well as assuring them they’ll pass the next audit: test their backups and restores, make sure everything is logged, and conduct incident response and disaster recovery exercises. Vendors should provide an incident management plan and a post mortem on any incident they have to handle.

Although the hosting provider handles security for the hosts, network, and operating systems, clients are responsible for security for users and applications. They should do “data mapping” so they know exactly where PHI is and what sensitive data is shared with SaaS services.

Clients should make sure to have proper encryption, including their backups, and that data is recoverable in a given timeframe. They have to make sure their antivirus software is up to date, even if the vendor claims to handle updates. When employees leaves, their accounts should be deleted “before they leave the building.”

Goolsby discussed the value of planning important security and compliance features from the start. If you don’t encrypt a data volume at the start or segment your network to allow for future traffic growth, these things are very hard to do later. He’s often seen clients defer such features because fixing something after they go live is too costly.

The question of “shadow IT” came up. New applications are needed constantly in a fast-changing treatment environment, and “you always want it yesterday,” but providers should be discouraged from going around the IT staff and installing their own applications or SaaS services.  IT leaders need to be proactive in providing the secure, HIPAA-compliant tools their users need so that unvetted shadow IT doesn’t become a problem in their organization.

Watch our interview with Kelly Goolsby from Nexcess to learn more about how you can ensure your hosting provider is compliant.

Learn more about Nexcess: https://www.nexcess.com/

Listen and subscribe to the Healthcare IT Today Interviews Podcast to hear all the latest insights from experts in healthcare IT.

And for an exclusive look at our top stories, subscribe to our newsletter and YouTube.

Tell us what you think. Contact us here or on Twitter at @hcitoday. And if you’re interested in advertising with us, check out our various advertising packages and request our Media Kit.

Nexcess is a proud sponsor of Healthcare Scene.

In a recent Healthcare IT Today interview, Kelly Goolsby, Director of Solution Architecture at Nexcess, says that many clients come to them after trying another managed hosting provider who made impressive claims but failed to follow through on compliance, security, and other promises.

Claiming to be a “show me” kind of guy, Goolsby recommends that clients not rely on promises made by potential vendors, but ask for proof and transparency. Check the logs to make sure that the expected antivirus software and other security measures are present. Some hosting providers are now being punished for non-compliance with HIPAA and other regulations. Migration to a new hosting service can take six months, so clients should try to choose a reliable vendor at the start.

Goolsby also says that regular audits, while important, are not enough, especially when a client is rolling out a new service or source of data. An audit is a look at the past, and therefore comes too late to prevent security problems. Clients should do regular checks that anticipate security needs as well as assuring them they’ll pass the next audit: test their backups and restores, make sure everything is logged, and conduct incident response and disaster recovery exercises. Vendors should provide an incident management plan and a post mortem on any incident they have to handle.

Although the hosting provider handles security for the hosts, network, and operating systems, clients are responsible for security for users and applications. They should do “data mapping” so they know exactly where PHI is and what sensitive data is shared with SaaS services.

Clients should make sure to have proper encryption, including their backups, and that data is recoverable in a given timeframe. They have to make sure their antivirus software is up to date, even if the vendor claims to handle updates. When employees leaves, their accounts should be deleted “before they leave the building.”

Goolsby discussed the value of planning important security and compliance features from the start. If you don’t encrypt a data volume at the start or segment your network to allow for future traffic growth, these things are very hard to do later. He’s often seen clients defer such features because fixing something after they go live is too costly.

The question of “shadow IT” came up. New applications are needed constantly in a fast-changing treatment environment, and “you always want it yesterday,” but providers should be discouraged from going around the IT staff and installing their own applications or SaaS services.  IT leaders need to be proactive in providing the secure, HIPAA-compliant tools their users need so that unvetted shadow IT doesn’t become a problem in their organization.

Watch our interview with Kelly Goolsby from Nexcess to learn more about how you can ensure your hosting provider is compliant.

Learn more about Nexcess: https://www.nexcess.com/

Listen and subscribe to the Healthcare IT Today Interviews Podcast to hear all the latest insights from experts in healthcare IT.

And for an exclusive look at our top stories, subscribe to our newsletter and YouTube.

Tell us what you think. Contact us here or on Twitter at @hcitoday. And if you’re interested in advertising with us, check out our various advertising packages and request our Media Kit.

Nexcess is a proud sponsor of Healthcare Scene.