Shared Responsibility Model_Webinar_-_7-19-16

Making Sense of the Cloud's Confusing
Shared Responsibility Model
Healthcare IT News Webinar: July 19, 2016

Shared Responsibility Can Create Confusion
CONFUSION & MISMATCHED EXPECTATIONS
?
Roles & Responsibilities
?
Data Security
?
Breach Reporting
?
Service Models
PROPRIETARY&CONFIDENTIAL 2

Objectives
•Refresher on HIPAA, the BAA and the Security Rule
•Understand the key roles in data ownership and how that relates to
shared responsibility in the cloud
•Understand Cloud deployment and service models
•Review the benefits and disadvantages of each service model
•Discuss a typical responsibility model aligned with the HIPAA Security
Ruleaswellasausecase
•Describe considerations for moving to the cloud

Background:
HIPAA Security Rules & The BAA

Business Associate Agreement (BAA)
The Fundamental Purpose of a BAA is to Protect Patient Data
•The CoveredEntitymust enter into a BAA with a Business Associate
•TheBusinessAssociatemusthaveaBAAwithSubcontractors
•Three Major Obligations of a BAA:
- Facilitate Patient Rights
- Complete Risk Analysis, Policies and Procedures
- Report Breaches and Liability
BAA Obligations FlowOutward

BA Breach Reporting
Internal Logging
External
Reporting
• Unsuccessful Security Incidents
• Breaches of less than 500 records
• Successful Security Incidents
• Breaches of more than 500 records

HIPAA Fines & Penalties
Violation Category
Did Not Know
Reasonable Cause
Willful Neglect: Corrected
Willful Neglect: Not Corrected
Each Violation
$100 - $50,000
$1,000 - $50,000
$10,000 - $50,000
$50,000
All Identical Violations
per Calendar Year
$1,500,000
$1,500,000
$1,500,000
$1,500,000

Key Roles in Data Ownership
Data Subject
An individual who is the
subject of personal data
Data Controller
A person (alone or jointly with
other persons) determines the
purpose for which, and the
manner in which any personal
data may be processed
Data Processor
Any person (other than an
employee of the data
controller) who processes data
on behalf of the controller
Data Steward
Responsible for data content,
context, and business rules
Data Custodians
Responsible for the safe
custody, transport, storage of the
data, and implementation
of business rules
Data Owner
Holds legal rights and complete
control over a single piece or
set of data elements. Define
distribution and policies

Cloud Service & Deployment Models

The Cloud Reference Model
Cloud Consumer
Cloud Auditor
Security
Audit
Portability / Interoperability
Security
Privacy
Cloud Service Management
Provisioning / Configuration
Service Layer
SaaS
Business Support
Cloud Broker
Service
Intermediation
Service
Aggregation
Privacy
Impact Audit PaaS
IaaS
Performance Service
Audit Arbitrage
Resource Abstraction & Control Layer
Physical Resource Layer
Hardware Facility

Cloud Consumer
Cloud Auditor
Security
Audit
Security
Privacy
Service Layer
SaaS
Business Support
Cloud Broker
Service
Intermediation
Service
Aggregation
Privacy
Impact Audit PaaS
IaaS
Performance Service
Audit Arbitrage
Hardware Facility

Cloud Deployment Models
Private
Cloud
• Owned or leased by a
single organization
• Operated solely for that
organization
Community
Cloud
•Shared by several
organizations
• Supports a specific
community
Hybrid
Cloud
• Combination of two or
more cloud models
Public
Cloud
•Owned by an
organization selling
cloud services
• Sold to the public or
large organizations

The BAA & Cloud Service Models

Cloud Service Models
Presentation Layer
API's
SaaS
Applications
Software as a Service
Data Content
Integration & Middleware
API's
Connectivity
Hardware
Facilities
PaaS
Platform as a Service
IaaS
Infrastructure as a Service

SaaS
Software delivery method. Provides access to software as a web-based service. Allows
access to business functionality, at less cost than purchasing software outright.
Customers CAN
Customers CANNOT
• Use provider's applications running on cloud infrastructure
• Access applications via client devices (e.g. thin-client web-
based, or a program interface
• Manage or control underlying infrastructure, including
network, servers, operating systems, storage, application
capabilities

SaaS Characteristics
Characteristics
Benefits
• Hosted App Management
• Software on Demand
• App and data access from anywhere
• Manage Ease of use / minimal administration
• Automatic updates and patch management
• Standardization and compatibility
• Global accessibility

BAA and the SaaS Model
Patient Data
Platform Applications Identity & Access Management Data Owner/Process can see and control
Limited to user interface and data presentation
Operating Systems, Network & Firewall Configurations
No control or visibility offered to Owner/Processor
Client-Side Data Server-Side Network Traffic
Encryption Encryption Protection
Cloud Foundation Services
Compute Storage Database Networking

PaaS
A platform allowing customers to develop, run, and manage applications without the
complexity of building and maintaining the infrastructure.
Customers CAN
Customers CANNOT
• Deploy applications that they purchased or developed
- Using programming languages, libraries, services, and other tools
• Control deployed applications
• Possibly control configuration settings for app-hosting
environment
• Manage or control underlying infrastructure, including OS

PaaS Characteristics
Characteristics
Benefits
• Support multiple language and frameworks
• Multiple hosted environments
•Flexibility
•Allow choice and reduce vendor "Lock-in"
• Ability to auto-scale
• OS can be changed/upgraded frequently
• One environment, globally distributed development teams
• Services from diverse resources around the globe
•Reduced cost

BAA and the PaaS Model
Patient Data
Platform Applications Identity & Access Management
Data Owner/Process can see and control
No control or visibility offered to Owner/Processor

IaaS
Computer infrastructure delivered as a service. Software and servers are purchased as fully
outsourced and billed on usage.
Customers CAN
Customers CANNOT
• Provision processing, storage, networks and other resources
• Deploy and run arbitrary software, including OS and apps
• Control the OS
• Possibly control some networking components (host
firewalls
• Manage or control underlying infrastructure

IaaS Characteristics
Characteristics
Benefits
• Support Scale
• Converged Network and IT Capacity Pool
• Self-service, on-demand capacity
• High reliability and resilience
• OS can be changed/upgraded frequently
• One environment, globally distributed development teams
• Services from diverse resources around the globe
•Reduced cost

BAA and the IaaS Model
Patient Data
Platform Applications Identity & Access Management Customer Accountability
Shared Responsibility
No Control or Visibility

Data Access with Service Models
Information SaaS PaaS IaaS Local
Networking ✘ ✘ ✘ ✔
Storage ✘ ✘ ✘ ✔
Servers ✘ ✘ ✘ ✔
Virtualization ✘ ✘ ✘ ✔
OS ✘ ✘ ✔ ✔
Middleware ✘ ✘ ✔ ✔
Runtime ✘ ✘ ✔ ✔
Data ✘ ✔ ✔ ✔
Application ✘ ✔ ✔ ✔
Access ✔ ✔ ✔ ✔
Control

Cloud Managed Service Models
Basic DIY Model Managed Cloud Services Model
Patient Data Patient Data
Platform Applications Identity & Access Management Platform Applications Identity & Access Management
Operating Systems, Network & Firewall Configurations Operating Systems, Network & Firewall Configurations
Client-Side Data Server-Side Network Traffic Client-Side Data Server-Side Network Traffic
Encryption Encryption Protection Encryption Encryption Protection
Cloud Foundation Services Cloud Foundation Services
Compute Storage Database Networking Compute Storage Database Networking
Customer Responsibility Customer Responsibility
Cloud Service Provider Responsibility Managed Services Provider Responsibility
Cloud Service Provider Responsibility

HIPAA Security Rule Responsibility RACI (Responsible, Accountable, Consulted, Informed)
Requirement Covered Entity Business Services Provider Cloud Provider
Associate
Security Management Process A, R R I IAssigned Security
Responsibility A, R R I IWorkforce Security A, R
R I IAccess Management A R
R IIncident Procedures AR C, I
IContingency Plans AR C, I
IEvaluation AC, I R
IBusiness Assoc. Contracts A, R I -
-Physical Access Controls AI I
RLogical Access Controls AC, I R
IWorkstation Use & Security A, R R I
-Device & Media Controls AC, I R
R
Audit Controls A R R C, I
Data & System Integrity A R R C, I
Person or Entity Authentication A C, I R I
Transmission Security A R R C, I
Policies, Procedures & Documentation A, R C, I C, I C, I

IaaS Deployment RACI
Use Case Scenario
Covered Entity
Cloud-based Appointment
Setting Application
Infrastructure managed
by dedicated healthcare
cloud provider
Infrastructure located on
a Public Cloud
Task
Provision Storage Account
Provision IaaS Networking
Firewall Management, Configuration
Breach Notification Plan
Data Encryption at Rest & In Flight
Provision IaaS Virtual Machine
OS Deployment & Hardening
OS Security Patch Management
Backup
Antivirus/Antimalware, Endpoint Protection
App Installation, Configuration
Monitoring (fabric, OS, app platform)
Monitoring Alerting / Notification
Desired State Configuration
Vulnerability Scanning
Provision Application Services instance
CMS Install, Setup, and Maintenance
Covered Entity
II
II
II
II
II
II
II
II
I
Business Associate
C, I
C, I
C, I
C, I
C, I
C, I
I
C, I
C, I
I
C
C, I
I
C, I
I
A, R
A, R
Services Provider
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
A, R
I
C, I
Iaa
S
App
s

Summary
Know your workload requirements
Integration requirements and dependencies
Specific architecture, compliance and security requirements
Fit the service model to workload requirements
IaaS vs. PaaS vs. SaaS
Different levels of control and information access
Define responsibilities with your provider
Create a RACI with your provider up front
Establish regular reviews to ensure responsibilities for you and
the provider are fulfilled
PROPRIETARY & CONFIDENTIAL 33

Questions?
Penalties

(602) 635-4002
chris.bowen@cleardata.com
1600 W. Broadway Road Tempe, AZ 85282
Chris Bowen, MBA, CIPP/US, CIPT
Chief Privacy & Security Officer

Shared Responsibility Model_Webinar_-_7-19-16

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Shared Responsibility Model_Webinar_-_7-19-16

Similaire à Shared Responsibility Model_Webinar_-_7-19-16 (20)

Shared Responsibility Model_Webinar_-_7-19-16