Source: https://broadstreet.io/legal/hipaa-compliance/
Timestamp: 2019-04-22 12:42:07+00:00

Document:
BroadStreet Health, LLC (“BroadStreet”) is committed to ensuring the confidentiality, privacy, integrity, and availability of all electronic protected health information (ePHI) it receives, maintains, processes and/or transmits on behalf of its Customers. BroadStreet provides secure and compliant cloud-based software as a service (SaaS) to its Customers to track and analyze community health. Thus, BroadStreet hosted software falls into the broad category of SaaS. As providers of compliant, hosted SaaS used by health care and community organizations, BroadStreet strives to maintain compliance with the Health Insurance Portability and Accountability Act (HIPAA) by proactively addressing information security, mitigating risk for its Customers, and assuring known breaches are completely and effectively communicated in a timely manner. The following documents address core policies used by BroadStreet to maintain compliance and assure the proper protections of infrastructure used to store, process, and transmit ePHI for BroadStreet Customers are enacted, transparent and continually updated.
This also means we make our HIPAA compliance policies available online for easy viewing and review, and version tracking of updates (see §1.4). This also includes BroadStreet HIPAA training materials. Thus, at BroadStreet we are continuously reviewing our approaches to protecting PHI, making sure any employees working with PHI are carefully vetted and trained, and doing this with fully transparent and verifiable methods.
When it comes to ePHI, the essential sections of the HIPAA Privacy Rule located at 45 CFR Part 160 and Subparts A and E of Part 164 is Section 164 Security and Privacy and the HITECH Act and Omnibus Rule: IT Security Provisions. This also includes the HITRUST Common Security Framework (CSF). With this in mind, below is a high-level overview of BroadStreet’s major architecture, guiding principles, and how these maximize BroadStreet’s security posture. A mapping of HIPAA safeguards and requirements to BroadSreet policies is available in §24.
SaaS Customers utilize hosted software and infrastructure from BroadStreet to track community health through automatically generated reports, embedded dashboards on their websites, and aggregated statistics. The software application is deployed into compliant servers run on systems secured and managed by BroadStreet. BroadStreet makes every effort to reduce the risk of unauthorized disclosure, access, and/or breach of SaaS data through network (firewalls, dedicated IP spaces, etc) and server settings (encryption at rest and in transit, OSSEC throughout the application, etc.).
BroadStreet provides HIPAA compliant hosted software for its Customers. BroadStreet’s company policies, procedures, and technologies follow HIPAA best practices and are hosted at Amazon Web Services (AWS) that itself supports BroadStreet’s application in a manner consistent with HIPAA, HITECH, and HITRUST CSF.
BroadStreet signs business associate agreements (BAAs) [see §23.] with its Customers. These BAAs outline BroadStreet obligations and Customer obligations, as well as liability in the case of a breach.
Certain aspects of compliance cannot be inherited (see §2.). Because of this, BroadStreet Customers, in order to achieve full compliance or HITRUST Certification, must implement certain organizational policies. These policies and aspects of compliance fall outside of the services and obligations of BroadStreet.
As mentioned, the physical infrastructure environment is hosted at AWS. The network components and supporting network infrastructure are contained within the AWS infrastructures and managed by AWS. BroadStreet does not have physical access into the network components. The BroadStreet environment consists of Cisco firewalls; Apache web servers; Python application servers; PostgreSQL database servers; OSSEC IDS services; Docker containers; and developer tool servers running on Linux Ubuntu.
Within the BroadStreet Platform on AWS all data transmission is encrypted and all hard drives are encrypted so data at rest is also encrypted; this applies to all servers – those hosting Docker containers, databases, APIs, log servers, etc. BroadStreet assumes all data may contain ePHI and provides appropriate protections based on that assumption.
In the case of SaaS Customers, it is the responsibility of the Customer to restrict, secure, and assure the privacy of all ePHI data accessed through the BroadStreet API or downloaded, as this is not under the control or purview of BroadStreet.
Additionally, IPtables is used on each server for logical segmentation. IPtables is configured to restrict access to only justified ports and protocols. BroadStreet has implemented strict logical access controls so that only authorized personnel are given access to the internal management servers.
The Apache web server and application servers are externally facing and accessible via the Internet. The database servers, where the ePHI resides, are located on the internal BroadStreet network and can only be accessed over a secure connection. Access to the internal database is restricted to a limited number of personnel and strictly controlled to only those personnel with a business-justified reason. Remote access to internal servers is otherwise not accessible except through application servers.
All software modules and operating systems are tested end-to-end for usability, security, and impact prior to deployment to production.
Refer to the GitLab repository at GitLab.com BroadStreet Policies for the full version history of these policies. Please send e-mail to hello@broadstreet.io to request access.
These HIPAA compliance materials come mostly from Datica Health, Inc, some of which have been modified by BroadStreet. We would like to thank Datica for being so generous in opening up their HIPPAA compliance and training materials and putting health consumers and the community first.
When BroadStreet Customers use BroadStreet SaaS infrastructure to store and process their ePHI, they inherit BroadStreet’s compliance for many of the HIPAA provisions. The following tables outline which HIPAA provisions Customers inherit from BroadStreet’s controls. HIPAA provisions inherited by BroadStreet only apply for data stored and/or processed on BroadStreets SaaS. Any data processed and stored by a BroadStreet Customer locally on their computers, servers or in their own cloud server is not inherited by BroadStreet.
BroadStreet implements policies and procedures to maintain compliance and integrity of data. The Security Officer and Privacy Officer are responsible for maintaining policies and procedures and assuring all BroadStreet workforce members, business associates, customers, and partners are adherent to all applicable policies. Previous versions of policies are retained to assure ease of finding policies at specific historic dates in time. Refer to the GitLab repository at GitLab.com BroadStreet Policies for the full version history of these policies. Please send e-mail to hello@broadstreet.io to request access.
All policies are stored and updated to maintain BroadStreet compliance with HIPAA, HITRUST, NIST, and other relevant standards. Updates and version control are done similarly to source code control.
Policy update requests can be made by any workforce member at any time. Furthermore, all policies are reviewed annually by both the Security Officer and the Privacy Officer to assure they are accurate and up-to-date.
The BroadStreet employee initiates a policy change request by creating an Issue with a GitLab pull request from a separate branch or repository containing the desired changes.
Once the review is completed, the Security Officer or Privacy Officer approves or rejects the Issue. If the Issue is rejected, it goes back for further review and documentation.
If the review is approved, the Security Officer or Privacy Officer then mark the Issue as Done, adding any pertinent notes required.
If the policy change requires technical modifications to production systems, those changes are carried out by authorized personnel.
All HIPAA policies are made accessible to all BroadStreet workforce members. The current master policies are published at https://broadstreet.io/hipaa/.
Changes are automatically communicated to all BroadStreet team members through integrations between GitLab and Slack that log all GitLab policy changes to a dedicated BroadStreet Slack Channel.
Version history of all BroadStreet policies is done via GitLab.
Backup storage of all policies is done with Dropbox.
The Security Officer initiates the policy review by creating an Issue in GitLab.
The Security Officer or the Privacy Officer is assigned to review the current BroadStreet policies (broadstreet.io/hipaa/).
If the review is approved, the Security Officer or Privacy Officer then marks the Issue as Done, adding any pertinent notes required.
Policy review is monitored on a quarterly basis using the Quality Management System reporting to assess compliance with above policy.
Additional documentation related to maintenance of policies is outlined in §5.3.1.
This policy establishes the scope, objectives, and procedures of BroadStreet’s information security risk management process. The risk management process is intended to support and protect the organization and its ability to fulfill its mission.
It is the policy of BroadStreet to conduct thorough and timely risk assessments of the potential threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) (and other confidential and proprietary electronic information) it stores, transmits, and/or processes for its Customers and to develop strategies to efficiently and effectively mitigate the risks identified in the assessment process as an integral part of the BroadStreet’s information security program.
Risk analysis and risk management are recognized as important components of BroadStreet’s corporate compliance program and information security program in accordance with the Risk Analysis and Risk Management implementation specifications within the Security Management standard and the evaluation standards set forth in the HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B), 164.308(a)(1)(i), and 164.308(a)(8).
These changes do not include routine updates to existing systems, deployments of new systems created based on previously configured systems, deployments of new Customers, or new code developed for operations and management of the BroadStreet Platform.
While making changes to BroadStreet physical equipment and facilities that introduce new, untested configurations.
BroadStreet performs periodic technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting the security of ePHI.
Any risk remaining (residual) after other risk controls have been applied, requires sign off by the senior management and BroadStreet’s Security Officer.
All BroadStreet workforce members are expected to fully cooperate with all persons charged with doing risk management work, including contractors and audit personnel. Any workforce member that violates this policy will be subject to disciplinary action based on the severity of the violation, as outlined in the BroadStreet Roles Policy.
The implementation, execution, and maintenance of the information security risk analysis and risk management process is the responsibility of BroadStreet’s Security Officer (or other designated employee), and the identified Risk Management Team.
The intent of completing a risk assessment is to determine potential threats and vulnerabilities and the likelihood and impact should they occur. The output of this process helps to identify appropriate controls for reducing or eliminating risk. Thus BroadStreet conducts an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the covered entity or business associate.
Risk mitigation involves prioritizing, evaluating, and implementing the appropriate risk-reducing controls recommended from the Risk Assessment process to ensure the confidentiality, integrity and availability of BroadStreet Platform ePHI. Determination of appropriate controls to reduce risk is dependent upon the risk tolerance of the organization consistent with its goals and mission.
Scheduled Basis – an overall risk assessment of BroadStreet’s information system infrastructure will be conducted annually. The assessment process should be completed in a timely fashion so that risk mitigation strategies can be determined and included in the corporate budgeting process.
As Needed – the Security Officer (or other designated employee) or Risk Management Team may call for a full or partial risk assessment in response to changes in business strategies, information technology, information sensitivity, threats, legal liabilities, or other significant factors that affect BroadStreet’s Platform.
BroadStreet has a Security Officer [164.308(a)(2)] and Privacy Officer [164.308(a)(2)] appointed to assist in maintaining and enforcing safeguards towards compliance. The responsibilities associated with these roles are outlined below.
The Privacy Officer is responsible for assisting with compliance and security training for workforce members, assuring organization remains in compliance with evolving compliance rules, and helping the Security Officer in his responsibilities. Current BroadStreet training is hosted at broadstreet.io/hipaa/hipaa-training/.
The current BroadStreet Privacy Officers are Tom Schmitt (tom@broadstreet.io) and Tracy Flood (tracy@broadstreet.io).
Existing workforce members as needed due to changes in security and risk posture of BroadStreet.
The Security Officer is responsible for facilitating the training and supervision of all workforce members [164.308(a)(3)(ii)(A) and 164.308(a)(5)(ii)(A)], investigation and sanctioning of any workforce member that is in violation of BroadStreet security policies and non-compliance with the security regulations [164.308(a)(1)(ii)(c)], and writing, implementing, and maintaining all polices, procedures, and documentation related to efforts toward security and compliance [164.316(a-b)].
The current BroadStreet Security Officer is James Walters (james@broadstreet.io).
The Security Officer, in collaboration with the Privacy Officer, is responsible for facilitating the development, testing, implementation, training, and oversight of all activities pertaining to BroadStreet’s efforts to be compliant with the HIPAA Security Regulations, HITRUST CSF, and any other security and compliance frameworks. The intent of the Security Officer Responsibilities is to maintain the confidentiality, integrity, and availability of ePHI.
Annually, and as necessary, reviews and updates documentation to respond to environmental or operational changes affecting the security and risk posture of ePHI stored, transmitted, or processed within BroadStreet infrastructure.
Applies consistent and appropriate sanctions against workforce members who fail to comply with the security policies and procedures of BroadStreet.
Mitigates, to the extent practicable, any harmful effect known to BroadStreet of a use or disclosure of ePHI in violation of BroadStreet’s policies and procedures, even if effect is the result of actions of BroadStreet business associates, customers, and/or partners.
Reports security efforts and incidents to administration immediately upon discovery. Responsibilities in the case of a known ePHI breach are documented in §12 the BroadStreet Breach Policy.
Although the Security Officer is responsible for implementing and overseeing all activities related to maintaining compliance, it is the responsibility of all workforce members (i.e. team leaders, supervisors, managers, directors, co-workers, etc.) to supervise all workforce members and any other user of BroadStreet’s systems, applications, servers, workstations, etc. that contain ePHI.
Take all reasonable steps to hire, retain, and promote workforce members and provide access to users who comply with the Security regulation and BroadStreet’s security policies and procedures.
All workforce members report non-compliance of BroadStreet’s policies and procedures to the Security Officer or other individual as assigned by the Security Officer. Individuals that report violations in good faith may not be subjected to intimidation, threats, coercion, discrimination against, or any other retaliatory action as a consequence.
The Security Officer promptly facilitates a thorough investigation of all reported violations of BroadStreet’s security policies and procedures. The Security Officer may request the assistance from others.
Provide individuals suspected of non-compliance of the Security rule and/or BroadStreet’s policies and procedures the opportunity to explain their actions.
The investigator thoroughly documents the investigation as the investigation occurs. This documentation must include a list of all employees involved in the violation.
A violation resulting in a breach of confidentiality (i.e. release of PHI to an unauthorized individual), change of the integrity of any ePHI, or inability to access any ePHI by other users, requires immediate termination of the workforce member from BroadStreet.
In the case of an insider threat, the Security Officer and Privacy Officer are to set up a team to investigate and mitigate the risk of insider malicious activity. BroadStreet workforce members are encouraged to come forward with information about insider threats, and can do so anonymously.
BroadStreet has procedures to create and maintain retrievable exact copies of electronic protected health information (ePHI) stored in conjunction with BroadStreet and for SaaS Customers. This policy, and associated procedures for testing and restoring from backup data, do not apply to SaaS Customers that do not choose BroadStreet Backup Service. The policy and procedures will assure that complete, accurate, retrievable, and tested backups are available for all systems used by BroadStreet.
Data backup is done as needed to ensure that data remains available. Violation of this policy and its procedures by workforce members may result in corrective disciplinary action, up to and including termination of employment.
Perform backups of all systems that process, store, or transmit ePHI for BroadStreet Customers, including SaaS Customers that utilize the BroadStreet Backup Service.
The BroadStreet Ops Team is designated to be in charge of backups.
A BroadStreet workforce member initiates the access request through the Security Officer and the Privacy Officers.
The Security Officer or Privacy Officer will grant access to systems as dictated by the employee’s job title. If additional access is required outside of the minimum necessary to perform job functions, the requester must include a description of why the additional access is required as part of the access request.
If the review is approved, the Security Officer or Privacy Officer then marks the Issue as Done, adding any pertinent notes required. The Security Officer or Privacy Officer then grants requested access.
New accounts will be created with a secure password that meets all requirements from §7.12, which may be changed on the initial login.
For non-production systems, access grants are accomplished by leveraging the access control mechanisms built into those systems. Account management for non-production systems may be delegated to a BroadStreet employee at the discretion of the Security Officer or Privacy Officer.
Access is not granted until receipt, review, and approval by the BroadStreet Security Officer or Privacy Officer.
All access to BroadStreet systems and services is reviewed and updated on a bi-annual basis to ensure proper authorizations are in place commensurate with job functions.
Any BroadStreet workforce member can request change of access using the process outlined in §7.2 paragraph 1.
In the case of non-personal information, such as generic educational content, identification and authentication may not be required. This is the responsibility of BroadStreet Customers to define, and not BroadStreet.
For production systems, this is enforced by creating non-privileged user accounts that must invoke sudo to perform privileged tasks.
Rights for privileged accounts are granted by the Security Officer or Privacy Officer.
Generic accounts are not allowed on BroadStreet systems.
Access is granted through encrypted tunnels.
BroadStreet maintains a minimum necessary approach to access to Customer data. As such, BroadStreet, including all workforce members, does not readily have access to any ePHI.
Role based access categories for each BroadStreet system and application are pre-approved by the Security Officer, or an authorized delegate of the Security Officer.
BroadStreet utilizes hardware and software firewalls to segment data, prevent unauthorized access, and monitor traffic for denial of service attacks.
All Customer support desk interactions must be verified before BroadStreet support personnel will satisfy any request having information security implications.
BroadStreet’s current support desk software requires users to authenticate before submitting support tickets.
Support issues submitted via BroadStreet’s dashboard require that users authenticate with their BroadStreet account before submitting support tickets.
Support issues submitted by email must be verified by BroadStreet personnel using a phone number that has been registered with the corresponding account.
Access to the BroadStreet Platform systems and applications is controlled by requiring unique User Login IDs and passwords for each individual user and developer.
Shared accounts are not allowed within BroadStreet systems or networks.
Automated log-on configurations that store user passwords or bypass password entry are not permitted for use with BroadStreet workstations or production systems.
Information systems automatically log users off the systems after 30 minutes of inactivity.
The following items apply to any workstations owned by BroadStreet.
Workstations may not be used to engage in any activity that is illegal or is in violation of organization’s policies.
Workstation hard drives will be encrypted.
All workstations are to have the following messages added to the lock screen and login screen: This computer is owned by BroadStreet Health, Inc. By logging in, unlocking, and/or using this computer you acknowledge you have seen, and follow, these policies (https://broadstreet.io/legal/) and have completed HIPAA training. Please contact us if you have problems with this – hello@broadstreet.io.
BroadStreet production systems are not accessible directly over wireless channels.
Passwords are rotated on a regular basis. This process is managed by the BroadStreet Security Officer.
The Human Resources Department (or other designated department), users, and their supervisors are required to notify the Security Officer upon completion and/or termination of access needs and facilitating completion of the “Termination Checklist”.
The user has been using their access rights inappropriately.
A user’s password has been compromised (a new password may be provided to the user if the user is not identified as the individual compromising the original password).
The Security Officer will terminate users’ access rights immediately upon notification, and will coordinate with the appropriate BroadStreet employees to terminate access to any non-production systems managed by those employees.
BroadStreet does not use paper records for any sensitive information. Use of paper for recording and storing sensitive data is against BroadStreet policies.
User IDs and passwords are used to control access to BroadStreet systems and may not be disclosed to anyone for any reason.
Passwords that must be stored in non-hashed format must be encrypted at rest.
Transmitted passwords must be encrypted in flight.
Passwords are inactivated immediately upon an employee’s termination.
The user submits a password reset request to hello@broadstreet.io. The request should include the system to which the user has lost access and needs the password reset.
The password-reset email inbox is used to track and store password reset requests. The Privacy Officer is the owner of this group and modifies membership as needed.
In the case of data migration, BroadStreet does, on a case by case basis, support customers in importing data. In these cases BroadStreet requires that all data is secured and encrypted in transit, such as by using SFTP or SCP for transferring files.
In the case of an investigation, BroadStreet will assist customers, at BroadStreet’s discretion, and law enforcement in forensics.
BroadStreet shall audit access and activity of electronic protected health information (ePHI) applications and systems in order to ensure compliance. The Security Rule requires healthcare organizations to implement reasonable hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. Audit activities may be limited by application, system, and/or network auditing capabilities and resources. BroadStreet shall make reasonable and good-faith efforts to safeguard information privacy and security through a well-thought-out approach to auditing that is consistent with available resources.
This policy applies to all BroadStreet Add-on systems that store, transmit, or process ePHI.
All connections to BroadStreet are monitored. Access is limited to certain services, ports, and destinations. Exceptions to these rules, if created, are reviewed on an annual basis.
BroadStreet’s auditing processes shall address access and activity at the following levels listed below. In the case of SaaS Customers, Application and User level auditing is the responsibility of the Customer; BroadStreet provides software to aggregate and view User and Application logs, but the log data collected is the responsibility of the SaaS Customer. Auditing processes may address date and time of each log-on attempt, date and time of each log-off attempt, devices used, functions performed, etc.
System: System level audit trails generally monitor and log user activities, applications accessed, and other system defined specific actions. BroadStreet utilizes file system monitoring from OSSEC to assure the integrity of file system data.
BroadStreet may log all incoming and outgoing traffic into and out of its environment. This includes all successful and failed attempts at data access and editing. Data associated with this data will include origin, destination, time, and other relevant details that are available to BroadStreet.
BroadStreet utilizes OSSEC to scan all systems for malicious and unauthorized software.
BroadStreet treats its Dashboard as a Platform Add-on and, as such, it logs all activity associated with Dashboard Access.
BroadStreet uses OSSEC to monitor the integrity of log files by utilizing OSSEC System Integrity Checking capabilities.
BroadStreet shall identify “trigger events” or criteria that raise awareness of questionable conditions of viewing of confidential information. The “events” may be applied to the entire BroadStreet Platform or may be specific to a Customer, partner, business associate, Platform Add-on or application (See Listing of Potential Trigger Events below).
Identification of which BroadStreet workforce members will be responsible for review.
Testing may be carried out internally or provided through an external third-party vendor. Whenever possible, a third party auditing vendor should not be providing the organization IT oversight services (e.g., vendors providing IT services should not be auditing their own services – separation of duties).
A request for an audit for specific cause must include time frame, frequency, and nature of the request. The request must be reviewed and approved by BroadStreet’s Privacy or Security Officer.
A request for an audit must be approved by BroadStreet’s Privacy Officer and/or Security Officer before proceeding. Under no circumstances shall detailed audit information be shared with parties without proper permissions and access to see such data.
Should the audit disclose that a workforce member has accessed ePHI inappropriately, the minimum necessary/least privileged information shall be shared with BroadStreet’s Security Officer to determine appropriate sanction/corrective disciplinary action.
Only de-identified information shall be shared with Customer or Partner regarding the results of the investigative audit process. This information will be communicated to the appropriate personnel by BroadStreet’s Privacy Officer or designee. Prior to communicating with customers and partners regarding an audit, BroadStreet will consider seeking risk management and/or legal counsel.
Audit information that is routinely gathered must be reviewed in a timely manner, currently monthly, by the responsible workforce member(s). On a quarterly basis, logs are reviewed to assure the proper data is being captured and retained.
Significant findings shall be reported immediately in a written format. BroadStreet’s security incident response form may be utilized to report a single event.
Security audits constitute an internal, confidential monitoring practice that may be included in BroadStreet’s performance improvement activities and reporting. Care shall be taken to ensure that the results of the audits are disclosed to administrative level oversight structures only and that information which may further expose organizational risk is shared with extreme caution. Generic security audit information may be included in organizational reports (individually-identifiable ePHI shall not be included in the reports).
Log review activity is monitored on a quarterly basis using the Quality Management System reporting to assess compliance with above policy.
Periodic monitoring of Customer and Partner activity shall be carried out to ensure that access and activity is appropriate for privileges granted and necessary to the arrangement between BroadStreet and the 3rd party. BroadStreet will make every effort to assure Customers and Partners do not gain access to data outside of their own Environments.
If it is determined that the Customer or Partner has exceeded the scope of access privileges, BroadStreet’s leadership must remedy the problem immediately.
If it is determined that a Customer or Partner has violated the terms of the HIPAA business associate agreement or any terms within the HIPAA regulations, BroadStreet must take immediate action to remediate the situation. Continued violations may result in discontinuation of the business relationship.
BroadStreet workforce members are provided training, education, and awareness on safeguarding the privacy and security of business and ePHI (see BroadStreet HIPAA Training). BroadStreet’s commitment to auditing access and activity of the information applications, systems, and networks is communicated through new employee orientation, ongoing training opportunities and events, and applicable policies. BroadStreet workforce members are made aware of responsibilities with regard to privacy and security of information as well as applicable sanctions/corrective disciplinary actions should the auditing process detect a workforce member’s failure to comply with organizational policies.
BroadStreet Customers are provided with necessary information to understand BroadStreet auditing capabilities.
Audit log data is retained locally on the audit log server for a one-month period.
For SaaS Customers, they choose the length of backup retention and availability that BroadStreet will implement and enforce.
All software development will be performed in compliance with the written policies concerning systems access, data integrity, and approved tools.
Specification of features and requirements typically includes visual design, prototyping and testing of user experience, including specifications and written descriptions of software functionality. Design, prototyping and user testing central to the BroadStreet process to ensure the software appropriately meets user needs. Thus, well before developers begin building the software, protypes are built for using testing with UX/UI design tools (e.g., Adobe XD).
For phases 2 and 3, estimate of resources is done by outlining and scoping the features from phase 1. The features and requirements are then reviewed and discussed with all important stakeholders to ensure the proposed software meets all compliance requirements. This also includes a breakdown of work effort into manageable units by the developer and final team approval of estimates.
For phase 4, iterative development will be performed locally by the developer and submitted for review by BroadStreet leadership on an ongoing basis. All developers will incorporate feedback and design changes if needed and iterate for further review until complete. This loosely reflects the Agile software development methodology process, but in a more continuous and on-going way.
In phase 5, Integration testing is performed utilizing a testing server which is securely accessible to permitted developers. Testing is essential to compliance as it allows for a thorough review of the software before it is made available to a wide audience of users in the live production environment.
Deployment to production in phase 6 is carried out by the CTO or a person designated by the CTO for that purpose. Deployments should be performed within scheduled maintenance windows to allow for detection and resolution of any technical issues without compromising user experience or compliance.
BroadStreet’s major production releases target a fixed once-a-month cycle on the 5th day of each month. Minor production releases are done continuously to ensure important software updates occur (e.g., bugs, patches, etc.).
Any updates to BroadStreet’s production software will be recorded within the applicable Git source and version control repositories to provide an accessible history of modifications to the software. Iterative monthly major releases and minor interim releases will be tagged with the release number and accompanied by a written summary of changes.
BroadStreet works with Subcontractors to assure restriction of physical access to systems used as part of the BroadStreet Platform. BroadStreet and its Subcontractors control access to the physical buildings/facilities that house these systems/applications, or in which BroadStreet workforce members operate, in accordance to the HIPAA Security Rule 164.310 and its implementation specifications. Physical Access to all of BroadStreet facilities is limited to only those authorized in this policy. In an effort to safeguard ePHi from unauthorized access, tampering, and theft, access is allowed to areas only to those persons authorized to be in them and with escorts for unauthorized persons. All workforce members are responsible for reporting an incident of unauthorized visitor and/or unauthorized access to BroadStreet’s facility.
Of note, BroadStreet does not have ready access to ePHI, it provides cloud-based, compliant infrastructure to covered entities and business associates. BroadStreet does not physically house any systems used by its Platform in BroadStreet facilities. Physical security of our Platform servers is outlined in §1.3.
BroadStreet implements an information security incident response process to consistently detect, respond, and report incidents, minimize loss and destruction, mitigate the weaknesses that were exploited, and restore information system functionality and business continuity as soon as possible.
Note: These policies were adapted from work by the HIPAA Collaborative of Wisconsin Security Networking Group. Refer to the linked document for additional copyright information.
The BroadStreet incident response process largely follows the process recommended by SANS, an industry leader in security.
Suspicious emails targeting specific BroadStreet staff members with administrative access to production systems.
BroadStreet employees must report any unauthorized or suspicious activity seen on production systems or associated with related communication systems (such as email or Slack). In practice this means keeping an eye out for security events, and letting the Security Officer know about any observed precursors or indications as soon as they are discovered.
The individual receiving the report notifies the Security Officer (if not already done).
The Security Officer, Privacy Officer, or BroadStreet representative appointed notifies any affected Customers and Partners. If no Customers and Partners are affected, notification is at the discretion of the Security and Privacy Officer.
In the case of a threat identified, the Security Officer is to form a team to investigate and involve necessary resources, both internal to BroadStreet and potentially external.
In this Phase, BroadStreet’s IT department attempts to contain the security incident. It is extremely important to take detailed notes during the security incident response process. This provides that the evidence gathered during the security incident can be used successfully during prosecution, if appropriate.
The IT department performs the necessary platform and system modifications.
The Follow-up Phase V represents the review of the security incident to look for “lessons learned” and to determine whether the process that was taken could have been improved in any way. It is recommended all security incidents be reviewed shortly after resolution to determine where response could be improved. Timeframes may extend to one to two weeks post-incident.
Create a “lessons learned” document.
It is important to note that the processes surrounding security incident response should be periodically reviewed and evaluated for effectiveness. This also involves appropriate training of resources expected to respond to security incidents, as well as the training of the general population regarding BroadStreet’s expectation for them, relative to security responsibilities. The incident response plan is tested annually.
In the case of a breach, BroadStreet shall notify all affected Customers. It is the responsibility of the Customers to notify affected individuals.
Breach Investigation: The BroadStreet Security Officer shall name an individual to act as the investigator of the breach (e.g., privacy officer, security officer, risk manager, etc.). The investigator shall be responsible for the management of the breach investigation, completion of a risk assessment, and coordinating with others in the organization as appropriate (e.g., administration, security incident response team, human resources, risk management, public relations, legal counsel, etc.) The investigator shall be the key facilitator for all breach notification processes to the appropriate entities (e.g., HHS, media, law enforcement officials, etc.). All documentation related to the breach investigation, including the risk assessment, shall be retained for a minimum of six years.
The cause of the breach, and the entity responsible for the breach, either Customer, BroadStreet, or Partner.
Timeliness of Notification: Upon discovery of a breach, notice shall be made to the affected BroadStreet Customers no later than 10 days after the discovery of the breach. It is the responsibility of the organization to demonstrate that all notifications were made as required, including evidence demonstrating the necessity of delay.
A brief description of what BroadStreet is doing to investigate the breach, to mitigate harm to individuals and Customers, and to protect against further breaches.
Methods of Notification: BroadStreet Customers will be notified via email and phone within the timeframe for reporting breaches, as outlined above.
Workforce Training: BroadStreet shall train all members of its workforce on the policies and procedures with respect to ePHI as necessary and appropriate for the members to carry out their job responsibilities. Workforce members shall also be trained as to how to identify and report breaches within the organization.
Complaints: BroadStreet must provide a process for individuals to make complaints concerning the organization’s patient privacy policies and procedures or its compliance with such policies and procedures.
Retaliation/Waiver: BroadStreet may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise by the individual of any privacy right. The organization may not require individuals to waive their privacy rights under as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.
Notice to Media: BroadStreet Customers are responsible for providing notice to prominent media outlets at the Customer’s discretion.
Notice to Secretary of HHS: BroadStreet Customers are responsible for providing notice to the Secretary of HHS at the Customer’s discretion.
A brief description of what BroadStreet is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches.
The BroadStreet Contingency Plan establishes procedures to recover BroadStreet following a disruption resulting from a disaster. This Disaster Recovery Policy is maintained by the BroadStreet Security Officer and Privacy Officer.
Identify the activities, resources, and procedures needed to carry out BroadStreet processing requirements during prolonged interruptions to normal operations.
Identify and define the impact of interruptions to BroadStreet systems.
Assign responsibilities to designated personnel and provide guidance for recovering BroadStreet during prolonged periods of interruption to normal operations.
Ensure coordination with other BroadStreet staff who will participate in the contingency planning strategies.
BroadStreet defined two categories of systems from a disaster recovery perspective.
BroadStreet recognizes that media containing ePHI may be reused when appropriate steps are taken to ensure that all stored ePHI has been effectively rendered inaccessible. Destruction/disposal of ePHI shall be carried out in accordance with federal and state law. The schedule for destruction/disposal shall be suspended for ePHI involved in any open investigation, audit, or litigation.
BroadStreet utilizes dedicated hardware from Subcontractors. ePHI is only stored on SSD volumes in our hosted environment. All SSD volumes utilized by BroadStreet and BroadStreet Customers are encrypted. BroadStreet does not use, own, or manage any mobile devices, SD cards, or tapes that have access to ePHI.
BroadStreet assumes all disposable media in its Platform may contain ePHI, so it treats all disposable media with the same protections and disposal policies.
All destruction/disposal of ePHI media will be done in accordance with federal and state laws and regulations and pursuant to the BroadStreet’s written retention policy/schedule. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner.
All BroadStreet Subcontractors provide that, upon termination of the contract, they will return or destroy/dispose of all patient health information. In cases where the return or destruction/disposal is not feasible, the contract limits the use and disclosure of the information to the purposes that prevent its return or destruction/disposal.
In the cases of a BroadStreet Customer terminating a contract with BroadStreet and no longer utilizing BroadStreet Services, the following actions will be taken depending on the BroadStreet Services in use. In all cases it is solely the responsibility of the BroadStreet Customer to maintain the safeguards required of HIPAA once the data is transmitted out of BroadStreet Systems.
In the case of SaaS Customer termination, BroadStreet will provide the customer with 30 days from the date of termination to export data.
In order to preserve the integrity of data that BroadStreet stores, processes, or transmits for Customers, BroadStreet implements strong intrusion detection tools and policies to proactively track and retroactively investigate unauthorized access. BroadStreet currently utilizes OSSEC to track file system integrity, monitor log data, and detect rootkit access.
BroadStreet firewalls monitor all incoming traffic to detect potential denial of service attacks. Suspected attack sources are blocked automatically. Additionally, our hosting provider actively monitors its network to detect denial of services attacks.
BroadStreet utilizes redundant firewall on network perimeters.
BroadStreet is proactive about information security and understands that vulnerabilities need to be monitored on an ongoing basis. BroadStreet may utilize a vulnerability scanner to consistently scan, identify, and address vulnerabilities on our systems. We also utilize OSSEC on all systems, including logs, for file integrity checking and intrusion detection.
Vulnerability management is performed by the BroadStreet Security Officer, or an authorized delegate of the Security Officer.
Reviewing reports and findings, as well as any further investigation into discovered vulnerabilities, is the responsibility of the BroadStreet Security Officer.
Vulnerabilities that are repeatable manually are documented and reviewed by the Security Officer and Privacy Officer to see if they are part of the current risk assessment performed by BroadStreet.
Those that are not part of the current risk assessment trigger a new risk assessment, and this process is outlined in detail in the BroadStreet Risk Assessment Policy.
Penetration testing is performed regularly as part of the BroadStreet vulnerability management policy.
BroadStreet takes data integrity very seriously. As stewards and partners of BroadStreet Customers, we strive to assure data is protected from unauthorized access and that it is available when needed. The following policies drive many of our procedures and technical settings in support of the BroadStreet mission of data protection.
Production systems that create, receive, store, or transmit Customer data (hereafter “Production Systems”) must follow the guidelines described in this section.
All access to Production Systems must be logged. This is done following the BroadStreet Auditing Policy.
All Production Systems must have OSSEC running. Detected malware is evaluated and removed.
Virus scanning software may be run on Production Systems for anti-virus protection at the discretion of the Security Officer. Presently we have deemed this unnecessary for our Linux production systems due to the low risk of viruses on the Linux platform which is further mitigated by our other security practices.
Selected hosts will be scanned daily for malicious binaries in critical system paths.
The applicable malware signature database is checked regularly and automatically updated if new signatures are available.
All Production Systems are to only be used for BroadStreet business needs.
In the case of PaaS Customers, updates to Application and Database versions are the responsibility of Customers, though BroadStreet will, at it’s own discretion, notify and recommend updates to Customer systems.
Administrators ensure that they are using current versions of all BroadStreet-managed software on Production Systems.
System, network, and server security is managed and maintained by the Security Officer in conjunction with the Dev Ops team.
Access to Production Systems is controlled using centralized tools.
Ensure BroadStreet Customer Production Data is segmented and only accessible to Customers authorized to access data.
All Production Data at rest is stored on encrypted volumes using encryption keys managed by BroadStreet.
All data transmission is encrypted end to end using encryption keys managed by BroadStreet. Encryption is not terminated at the network end point, and is carried through to the application.
Transmission encryption keys use a minimum of 2048-bit RSA keys, or keys and ciphers of equivalent or higher cryptographic strength (e.g., 256-bit AES session keys in the case of IPsec encryption).
In the case of BroadStreet provided APIs, provide mechanisms to assure person sending or receiving data is authorized to send and save data.
Despite not being a requirement within HIPAA, BroadStreet understands and appreciates the importance of health data retention. Acting as a subcontractor, and at times a business associate, BroadStreet is not directly responsible for health and medical records retention as set forth by each state. Despite this, BroadStreet has created and implemented the following policy to make it easier for BroadStreet Customers to support data retention laws.
Current BroadStreet Customers who have data stored by BroadStreet as a part of the BroadStreet Service.
If no response to notice in #1 above within 7 days, or if Customer responds they do not want to reinstate account, Customer is sent directions for how to download their data from BroadStreet and/or to have BroadStreet continue to store the data at a rate of $25/month for up to 100GB. If there is more than 100GB of data, BroadStreet will work with Customer to determine storage costs.
If Customer downloads data or does not respond to notices from BroadStreet within 30 days, BroadStreet removes data from BroadStreet systems and Customer is sent notice of removal of data.
BroadStreet is committed to ensuring all workforce members actively address security and compliance in their roles at BroadStreet. As such, training is imperative to assuring an understanding of current best practices, the different types and sensitivities of data, and the sanctions associated with non-compliance.
All workforce members who have access to ePHI, including contractors, are given training on security policies and procedures, including operations security, within 30 days of employment.
Current BroadStreet training is hosted at broadstreet.io/hipaa/hipaa-training.
Employees must complete this training before accessing production systems containing ePHI.
These workforce members are granted access to formal organizational policies, which include the sanction policy for security violations.
The BroadStreet Employee Handbook clearly states the responsibilities and acceptable behavior regarding information system usage, including rules for email, Internet, mobile devices, and social media usage.
Workforce members are required to sign an agreement stating that they have read and will abide by all terms outlined in the BroadStreet Employee Handbook, along with all policies and processes described in this document.
A Human Resources representative will provide the agreement to new employees during their onboarding process.
BroadStreet does not allow mobile devices to connect to any of its production networks.
These workforce members are educated about the approved set of tools to be installed on workstations.
These workforce members are given HIPAA training within 30 days of beginning employment. Training includes HIPAA reporting requirements, including the ability to anonymously report security incidents, and the levels of compliance and obligations for BroadStreet and its Customers and Partners.
These remote (teleworking) workforce members are trained on the risks, the controls implemented, their responsibilities, and sanctions associated with violation of policies. Additionally, remote security is maintained through the use of VPN tunnels for all access to production systems with access to ePHI data.
Employees may only use BroadStreet-purchased and -owned workstations for accessing production systems with access to ePHI data.
Any workstations used to access production systems must be configured as prescribed in §7.8.
BroadStreet may monitor access and activities of all users on workstations and production systems in order to meet auditing policy requirements (§8).
Access to internal BroadStreet systems can be requested using the procedures outlined in §7.2. All requests for access must be granted by the BroadStreet Security Officer.
Request for modifications of access for any BroadStreet employee can be made using the procedures outlined in §7.2.
BroadStreet employees are strictly forbidden from downloading any ePHI to their workstations.
Restricting transfers of ePHI is enforced through technical controls as described in §7.13.
Employees found to be in violation of this policy will be subject to sanctions as described in §5.3.3.
Employees are required to cooperate with federal and state investigations.
Employees must not interfere with investigations through willful misrepresentation, omission of facts, or by the use of threats against any person.
BroadStreet workforce members are to escalate issues using the procedures outlined in the Employee Handbook. Issues that are brought to the Escalation Team are assigned an owner. The membership of the Escalation Team is maintained by the Chief Executive Officer.
Security incidents, particularly those involving ePHI, are handled using the process described in §11.2. If the incident involves a breach of ePHI, the Security Officer will manage the incident using the process described in §12.2. Refer to §11.2 for a list of sample items that can trigger BroadStreet’s incident response procedures; if you are unsure whether the issue is a security incident, contact the Security Officer immediately.
Create an Issue in the BroadStreet GitLab.
The Issue is reviewed by another member. If the Issue is rejected, it goes back for further evaluation and review.
BroadStreet utilizes a suite of approved software tools for internal use by workforce members for building and maintaining the BroadStreet SaaS application. These software tools are either self-hosted, with security managed by BroadStreet, or they are hosted by a Subcontractor with appropriate business associate agreements in place to preserve data integrity. Use of other tools requires approval from BroadStreet leadership.
GitLab. GitLab is an open source tool built on top of Git, the version control platform. It is utilized for storage of configuration scripts and other infrastructure automation tools, as well as for source and version control of application code used by BroadStreet.
Dropbox. Dropbox is used for storage of files and sharing of files with Partners and Customers. BroadStreet has executed a BAA with Dropbox.
Google Apps. Google Apps is used for email and document collaboration. Google Apps is not to be used to store or share ePHI data.
BroadStreet makes every effort to assure all 3rd party organizations are compliant and do not compromise the integrity, security, and privacy of BroadStreet or BroadStreet Customer data. 3rd Parties include Customers, Partners, Subcontractors, and Contracted Developers.
BroadStreet does not allow 3rd party access to production systems containing ePHI.
All connections and data in transit between the BroadStreet Platform and 3rd parties are encrypted end to end.
No BroadStreet Customers or Partners have access outside of their own environment, meaning they cannot access, modify, or delete anything related to other 3rd parties.
Application: An application hosted by BroadStreet, either maintained and created by BroadStreet, or maintained and created by a Customer or Partner.
Application Level: Controls and security associated with an Application. In the case of SaaS Customers, BroadStreet does not have access to and cannot assure compliance with security standards and policies at the Application Level.
Backup Service: A logging service for unifying system and application logs, encrypting them, and providing a dashboard for them. Offered with all BroadStreet Add-ons and as an option for SaaS Customers.
Disaster Recovery Service: A disaster recovery service for disaster recovery in the case of system unavailability. This includes both the technical and the non-technical (process) required to effectively stand up an application after an outage. Offered with all BroadStreet Add-ons and as an option for SaaS Customers.
Customers: Contractually bound users of BroadStreet Platform.
IDS Service: An Intrusion Detection Service for providing IDS notification to customers in the case of suspicious activity. Offered with all BroadStreet Add-ons and as an option for SaaS Customers.
Logging Service: A logging service for unifying system and application logs, encrypting them, and providing a dashboard for them. Offered with all BroadStreet Add-ons and as an option for SaaS Customers.
Organization: For the purposes of this policy, the term “organization” shall mean BroadStreet.
Partner: Contractual bound 3rd party vendor with integration with the BroadStreet Platform. May offer Add-on services.
Platform: The overall technical environment of BroadStreet.
SaaS: Software as a service (or SaaS; pronounced /sæs/ is a method of delivering centrally hosted applications over the Internet—as a service. SaaS applications are sometimes called web-based software, on-demand software, or hosted software. In essence, SaaS applications run on a SaaS provider’s servers.
Vendors: Persons from other organizations marketing or selling products or services, or providing services to BroadStreet.
Definitions For purposes of this BAA, any capitalized terms not otherwise defined herein will have the meaning given to them in the Agreement or HIPAA.
“Protected Health Information” or “PHI” will have the meaning given to it under HIPAA.
This BAA applies to the extent Company is acting as a Business Associate, to create, receive, maintain or transmit PHI between itself and Customer, and where Customer is deemed under HIPAA to be acting as a Business Associate of its customers. Company is contractually obligated to the Covered Entities to protect and secure Protected Health Information in accordance with HIPAA and the terms of Company agreements with the Covered Entities. This BAA governs Company and Customer’s receipt, use, creation and storage of PHI and supplements as required in order to allow both parties to comply with HIPAA. Except as so supplemented and/or amended, the terms of the Agreement shall continue unchanged and shall apply with full force and effect to govern the matters addressed in this BAA and in the Agreement.
By Company. Company may use and disclose PHI only as permitted under HIPAA, Subparts C and E of 45 CFR Part 164, and as specified in the Agreement and this BAA. Company may also use and disclose PHI for the proper management and administration of its business and to carry out its legal responsibilities, provided that any disclosure of PHI for such purpose may only occur if (i) required by applicable law, or (ii) Company obtains written reasonable assurances from the person to whom PHI will be disclosed that it will be held in confidence, used only for the purpose for which it was disclosed and that Company will be promptly notified of any Breach.
By Customer. Customer will neither request nor require Company to use or disclose PHI in any manner that would not be permissible under HIPAA (unless otherwise expressly permitted under HIPAA for a Business Associate). Customer will also take appropriate measures to limit its use or disclosure of PHI to Company to the minimum extent necessary for Company to carry out its authorized use of such PHI. Customer agrees that Company has no obligation to protect PHI under this BAA to the extent Company creates, receives, maintains or transmits such PHI outside of the scope of the Agreement.
Appropriate Safeguards The parties will use appropriate safeguards designed to prevent against unauthorized use or disclosure of PHI and protect the integrity of PHI and availability of PHI, consistent with this BAA, and as otherwise required under the Security Rule and Subpart C of 45 CFR Part 164, in connection with the Agreement.
Reporting Unless otherwise consistent with the legitimate needs of applicable law enforcement and applicable laws in accordance with 45 CFR 164.410, Company will promptly notify Customer within ten (10) days following the discovery of a Breach resulting in the unauthorized use or disclosure of PHI in violation of this BAA or the Agreement in accordance with 45 CFR 164.410, Further, such notice shall occur only after taking any measures necessary to determine the scope of the Breach and to restore the reasonable integrity of the Company Services by using commercially reasonable efforts to mitigate any further harmful effects to the extent practicable. Company agrees to maintain records of all Security Incidents and provide notice to Customer of successful Security Incidents pursuant to 45 C.F.R. 164.314 or as otherwise provided for in the Agreement or this BAA.
Agents and Subcontractors Company will take appropriate measures to ensure that any agents and subcontractors used by Company to perform its obligations under the Agreement that require access to PHI on behalf of Company are bound by written obligations that provide the same material level of protection for PHI as this BAA and the Agreement, and in accordance with 45 CFR Parts 164.502(e)(1)(ii) and 164.308(b)(2).
Accounting Rights Company will make available to Customer PHI in a Designated Record Set as necessary so Customer may fulfill its obligation to its customers to give individuals their rights of access, amendment and accounting in accordance with HIPAA, HITECH and 45 CFR Parts 164.524, 164.526 and 164.528 (including without limitation a disclosure permitted under 45 CFR 164.512).
Access to Records To the extent required by law, and subject to applicable attorney client privileges, Company will make its internal practices, books and records concerning the use and disclosure of PHI received from Customer, or created or received by Company on behalf of Customer, available to the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) for the purpose of the Secretary determining compliance with this BAA.
Return/Destruction of Information Company agrees that upon termination of the Agreement or upon Customer’ request, Company will destroy all PHI received from Customer, or created or received by Company on behalf of Customer, which Company still maintains in accordance with the Agreement; provided, however, that if such destruction is not feasible, Company will so notify Customer and extend the protections of this BAA to the PHI not destroyed and limit further uses and disclosures to those purposes that make the destruction of the PHI infeasible. In the event this BAA is terminated earlier than the Agreement, Company must delete any PHI it maintains and cease to create, receive, maintain or transmit such PHI.
Breach/Cure Customer may immediately terminate this BAA and the Agreement upon thirty (30) days written notice to Company if Company has materially breached this BAA and such breach has not been cured within such thirty (30) days.
Term This BAA will expire upon the earlier of: (i) a permitted termination in accordance with this BAA, (ii) the natural expiration or termination of the Agreement between the parties, or (ii) the execution of an updated BAA that supersedes this BAA.
Interpretation. The terms of this BAA shall prevail in the case of any conflict with the terms of the Agreement.
Survival. Notwithstanding any other provision of this BAA to the contrary, the terms of sections 1, 2, 3, 6, 9 and 12 of this BAA shall survive termination of this BAA and continue indefinitely solely with respect to PHI Company retains in accordance with this BAA.
No Third Party Beneficiaries. Nothing in this BAA shall confer upon any person other than the Parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.
Policies and Procedures. Company agrees to maintain policies and procedures governing the protection of PHI and provide, upon Customer’ request, access to and copies of any such policies and procedures.
Subpoenas. Company agrees to provide notice to Customer of any subpoena or other legal process seeking PHI received from or created on behalf of Customer, or otherwise relating to Company’s services, duties and obligations under the Company Agreement and/or the BAA. Such notice shall be provided within forty-eight (48) hours of Company’s receipt of such subpoena or legal process.
IN WITNESS WHEREOF, each of the undersigned has caused this BAA to be executed in its name and on its behalf by its duly authorized representative.
Below is a list of HIPAA Safeguards and Requirements and the BroadStreet controls in place to meet those.

References: §1
 §24
 §23
 §2
 §5
 §12
 §7
 §7
 §1
 §7
 §7
 §7
 §7
 §5
 §11
 §12
 §11