Medsender HIPAA Compliance

Learn how Medsender not only complies with HIPAA, but builds a better, more secure environment to mitigate risks. Our platform service is fully HIPAA compliant and meets or exceeds security standards set forth by HIPAA.

In an effort to be transparent, we go into a good amount of detail on this page. As a lead in, below is a high level summary of our major architecture, our guiding principles, and how it maximizes our security posture.

See the finer grain details of how we comply with HIPAA below. These are mapped to specific HIPAA rules. There’s a lot here but again, we are taking this responsibility on so that our customers don’t have to. Controls marked with an (Req) are Required. Controls marked with an (A) are Addressable. In our environment, controls outlined below are implemented on all infrastructure that processes, stores, transmits or can otherwise gain access to ePHI (electronic protected health information). If you have questions, please email us.

Administrative Safeguards (see 164.308)

Taken directly from the wording of the Security Rule, administrative safeguards are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity’s workforce in relation to the protection of that information.

There aren’t specific security settings in this section, and the most important area covered is the risk assessment. The risk assessment is a fundamental process for any organization that wants to become compliant.

Security Management Process - 164.308(a)(1)(i)

Medsender, Inc. has a risk management policy that defines the risk analysis and risk management process. This policy is operationalized with processes to conduct regularly risk assessments. Medsender uses NIST800-30 and 800-26 for performing risk analysis. Our policy begins with an inventory of all Medsender systems, mapping of where ePHI is processed, transmitted, or stored, identification of threats, risks, and likelihood, and the mitigation of risks. Policies address risk inherent within the environment and mitigating the risk to an acceptable and reasonable level.

Medsender has a Sanction Policy that has sanctions for employees not adhering to certain policies, and for specifically violating HIPAA rules.

Policies and procedures address the requirements of monitoring and logging system level events and actions taken by individuals within the environment. All requests into and out of the Medsender network are logged, as well as all system events. Medsender, has implemented multiple logging and monitoring solutions to track events within their environment and to monitor for certain types of behavior. Log data is regularly reviewed. Additionally, proactive alerts are enabled and triggered based on certain suspicious activity.

Assigned Security Responsibility - 164.308(a)(2)

Medsender, Inc. has formally assigned and documented its security officer. Our security office is Mahmoud Tohmaz. He can be reached by email at mahmoud.tohmaz [at] medsender.com.

Workforce Security - 164.308(a)(3)(i)

Medsender, Inc. has policies in place that require workforce members requesting access to ePHI to submit an authorization form that is signed and acknowledges their responsibility of safeguarding ePHI. The form must also be approved by the Security Officer. Once signed and approved, then the individual will be provisioned access to systems deemed business necessary. All Access to ePHI is based on minimum necessary requirements and least privilege.

Medsender policies define the immediate removal of access once an employee has been terminated, with the Security Officer responsible for terminating the access. Once HR initiates the termination process the termination checklist is referenced to ensure necessary actions are taken to remove systems and facilities access.

Information Access Management - 164.308(a)(4)(i)

Medsender, Inc. does not perform the functions of a Healthcare Clearinghouse so aspects of this section are not applicable.

The security officer determines the roles necessary for each system and application. When access is needed to Medsender infrastructure, a request and acknowledgement form is signed and then approved by the Security Officer.

Medsender has a formal process for requesting additional access to ePHI, and again Medsender customers must approve all requests concerning ePHI.

Security Awareness and Training - 164.308(a)(5)(i)

Medsender, Inc. has a Security Awareness training policy in place that requires new employees and current employees to conduct training upon hire and annually thereafter. Minimum training is done annually, with regular informal security and compliance training done every other week.

Medsender proactively assesses and tests for malicious software within their environment, both infrastructure and workstations. Members of the Medsender team monitor bug and vulnerability lists to assure they remain up to date.

Medsender is monitoring and logging successful and unsuccessful log-in attempts to the servers within its environment and policies are in place requiring audit logging, which includes login attempts.

Password configurations are set to require that passwords are a minimum of 8 character length, 90 day password expiration, account lockout after 5 invalid attempts, password history of last 4 passwords remembered, and account lockout after 15 minutes of inactivity.

Security Incident Procedures - 164.308(a)(6)(i)

Medsender has implemented a formal incident response plan (IRP), which discusses the procedures for identifying, responding to, and escalating suspected and confirmed security breaches. Medsender has implemented an incident response team for the purposes of dealing with potential security breaches. The IRP has specific types of incidents to look out for, as well as some common types of incidents that are monitored for within the environment.

Contingency Plan - 164.308(a)(7)(i)

Medsender, Inc has a formal Backup and Recovery Policy that defines the data backup strategy including: schedule, associated responsibilities, and any risk-assessed exclusion to the backup schedule.

Medsender has a formal Disaster Recovery plan to ensure the efficient recovery of critical business data and systems in the event of a disaster. The DR plan includes specific technical procedures necessary to reinstate the infrastructure and data to allow critical business functions to continue business operations after a disaster has occurred. Additionally, the Medsender DR plan includes requirements for performing annual testing of the DR plan to ensure its effectiveness.

Medsender has a DR plan, or a Business Continuity Plan (BCP), to aid in the efficient recovery of critical business functions after a disaster has been declared. The BCP goes into effect after facility outage of 24 hours. The BCP identifies critical information necessary to resume business operations such as: Hardware/software requirements, recovery time objectives, forms, employee/vendor contact lists, alternate working procedures, emergency access procedures, and a data and application criticality analysis. The BCP includes an Emergency Mode Operations Plan that addresses the access and protection of ePHI while operating in emergency mode.

The DR and BPC plans are reviewed and tested annually or whenever significant infrastructure changes occur.

Medsender has a performed an applications and data criticality analysis that details what systems and application need be recovered and their specific order in the recovery process.

Evaluation - 164.308(a)(8)

Medsender, Inc. has formal internal policies and procedures for conducting periodic technical and non-technical testing. These define procedures for performing quarterly internal and external vulnerability scanning, as well as annual penetration testing. Vulnerability scanning is performed regularly on a weekly basis and with any major changes in infrastructure. Additionally, non-technical evaluations occur on an annual basis to ensure that the security posture of Medsender is at the defined level, approved by management, and communicated down to Medsender employees.

Business Associate Contracts and Other Arrangement - 164.308(b)(1)

Medsender, Inc. has a formalized template, as well as policies in place regarding Business Associate Agreements and written contracts. Medsender has engaged a third party provider for hosting responsibilities and has written attestations of safeguarding its data. Additionally, Medsender performs due diligence in assuring that third party providers they select go through their due diligence process and provide services consistent with Medsender’s security and compliance posture.

Physical Safeguards (see 164.310)

This one is pretty straight forward - physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. Data center security is typically easier to address than office security, though at Medsender we address both.

Facility Access Controls - 164.310(a)(1)

Medsender, Inc. infrastructure supporting its environments is hosted at Google Cloud, which provides hosting and recovery services for the infrastructure.

Medsender headquarters also has written policies and procedures for safeguarding the corporate location, which includes workstations with access to the environment, from unauthorized physical access. Smart locks are used to track access and all visitors are logged and escorted.

The Medsender environment is entirely hosted and built on hardware components provided by GCP which Medsender would never have access into.

Workstation Use - 164.310(b)

Medsender, Inc. has policies in place that define the acceptable uses in place for workstations within the environment. These policies define the acceptable and unauthorized uses of personnel that provided workstations with access to systems potentially interacting with ePHI. These policies are enforced on all workstations. All internal email uses HIPAA-compliant vendors.

Workstation Security - 164.310c

Medsender has a formal Workstation and Portable Media Security Policy that identifies the specific requirements of each device. The policies define the requirements for using and/or restricted specific actions while engaged with any ePHI. Additionally, workstations are secured appropriately to limit exposure to breaches. Firewalls and hard disk encryption are used on all workstations. Actions and events are monitored and controlled, with user restrictions on downloading or copying any ePHI without documented approval and business justification. Additionally, all file storage internally at Medsender utilizes HIPAA-compliant cloud-based vendors (currently Google Apps and Google Cloud Storage).

Device and Media Controls - 164.310(d)(1)

Medsender has policies and procedures for all workstations that interact with and may potentially become exposed to ePHI. These policies have requirements for secure media disposal so that ePHI cannot be recovered from these systems.

Medsender has Media re-use requirements for the workstations, despite the fact that these workstations do not have access to and interaction with ePHI.

Technical Safeguards (see 164.312)

This section of HIPAA outlines the technology and the policy and procedures for its use that protect electronic protected health information and control access to it. It is important to note that these requirements are not prescriptive, and there is flexibility in implementation. The key is that measures that are reasonable and appropriate are implemented to safeguard ePHI.

Access Control - 164.312(a)(1)

All users within the Medsender environment are issued a unique user name and password. All accounts are local and unique. General/shared accounts are not in place and root access is restricted and monitored.

Medsender has procedures and a process for obtaining access to ePHI should an emergency or disaster occur.

Medsender systems settings on all of its servers have session timeout features enabled and configured to terminate sessions after a period of 30 minutes or less.

Medsender encrypts all stored data in its environment using 256-bit AES encryption. Additionally, all data in transit is encrypted end to end (more below).

Audit Controls - 164.312(b)

Medsender, Inc. has policies in place addressing audit trail requirements. Systems within the its environment are logging to a centralized logging solution, Logstash, which is monitoring system level events and contains user id, timestamp, event, origination, and type of event. These logs are constantly monitored for suspicious events and alerts are generated to any type of behavior that is suspicious.

Integrity - 164.312c(1)

Medsender has employed a centralized access control system for authenticating and accessing internal systems where ePHI resides. Currently, Medsender employees access a bastion host using an SSH-2 connection to access internal systems. Accounts on the internal database are restricted to a limited number of personnel, with logging in place to track all transactions.

Person or Entity Authentication - 164.312(d)

Medsender, Inc. has a formal policy that describes the process of verifying a person’s identity before unlocking their account, resetting their password, and/or providing access to ePHI.

Transmission Security - 164.312(e)(1)

All data in transit with Medsender is sent over internet connections through an TLS1.1/TLS1.2 encrypted mechanism. Load balancers segment the traffic and send transmissions of the data to the application servers via an encrypted connection using the TLS protocol. Additionally, none of the internal application servers, database servers, and log and monitoring servers are accessible via public internet. All internal servers must be accessed via bastion host which are not accessible from the internet and require an SSH connection.

Organizational Requirements (see 164.314)

These requirements simply outline the need for business associate agreements (BAAs) between covered entities and business associates. This requirement has recently been extended to require business associate agreements between business associates and all subcontractors. That linking, chaining together of of BAAs, has created for new and interesting legal and business questions. We’ve taken a proactive approach to BAAs to mitigate risk for our customers and assure consistency along the chain of BAAs.

Business Associate Contracts or Other Arrangements - 164.314(a)(1)(i)

Medsender has a formalized policy and process is in place concerning BAAs. BAA templates are in place and BA contracts are reviewed for consistency. All paying customers on Medsender have BAAs in place. Medsender has a formal policy and process in place for performing due diligence with any third party or vendor before engaging them. Additionally, contracts are retained that detail the responsibility of safeguarding any information to which the provider may have access, as well as creating consistency for Medsender and Medsender customers.

Policies and Procedures and Documentation Requirements (see 164.316)

Policies and Procedures - 164.316(a)

Medsender has a formalized Policy Management program that ensures that policies are developed, implemented, and updated according to best practice and organization requirements. In the words of our auditors, this is a policy about our policies.

Documentation - 164.316(b)(1)(i)

Medsender retains the necessary policies and documentation for a minimum of 6 years. All policies and procedures are available and distributed to personnel on the company shared drive (currently Box and github). Medsender has an update and review process for reviewing all policies and procedures and updating them as necessary. Additionally, Medsender tracks and maintains revision history, approval signature, and timestamps to ensure policies are reviewed and updated according to organization requirements.

HITECH Act and Omnibus Rule: IT Security Provisions

These were updates made to strengthen the Privacy, Security, and Breach Notifications rules within HIPAA. These updates went into effect in 2013 and were the driving force for many existing IaaS vendors to begin signing BAAs.

Notification in the Case of Breach - 13402(a) and 13402(b)

Medsender has a formal breach notification policy that addresses the requirements of notifying affected individuals and customers of a suspected breach of ePHI. These policies outline the relevant and responsible parties in case of a breach, forensics work to discover extent of breach, reason for breach, correction of infrastructure to prevent future breach, and requirements of notifying customers of a breach within 24 hours. Medsender is a defined Business Associate or subcontractor according to HIPAA regulations and the specific customer relationship.

Timeliness of Notification - 13402(d)(1)

Medsender has a breach notification policy that addresses the requirements of notifying the affected individuals or customers within 24 hours of a breach.

Content of Notification - 13402(f)(1)

Medsender has Breach Notification policies in place and they include a brief description of the breach, including the date of the breach and the date of the discovery of the breach, if known. Medsender breach notification policies include a description of the types of unsecured protected health information that were involved in the breach (such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code or other types of PII were involved) and what the source of the breach was. Our breach notification policies include steps the individual should take to protect themselves from potential harm resulting from the breach. Our policies also provide the contact procedures for individuals to ask questions or learn additional information, which includes a toll-free telephone number, an e-mail address, Web site, or postal address.