Source: https://chino.io/compliance-resources-us-hipaa
Timestamp: 2017-08-18 01:01:02
Document Index: 108574973

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

HIPAA Definition & Specifications
Chino.io implementation
§ 164.308(a)(1): "Implement policies and procedures to prevent, detect, contain and correct security violations."
Chino.io performs risk analysis and assessments on regular basis. The relevant risks and mitigation procedures are also documented in the Chino.io Quality Management and Security Management Systems which has been certified according to ISO 9001 and ISO 27001 certification standards by an external auditing firm.
We manage our employees accounts in such a way that everyone has less privileges as possible. The access to PHI data is permitted only to employees having the highest privilegdes and each access is logged.
Chino.io implements a detailed tracking of all actions to data and API, which constitutes the basis for the audit logs and monitoring system which allows both Chino.io team and its users to assess and monitor the access to data in a non repudiable manner.
No Implementation Specifications
Jovan Stevovic and Stefano Tranquillini are assigned to the Privacy and Security Roles respectively.
“Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under [the Information Access Management standard], and to prevent those workforce members who do not have access under [the Information Access Management standard] from obtaining access to electronic protected health information.”
As mentioned above, the Chino.io employees have access to as less as possible information to the information and the system components. This includes access to source code, different VMs, Encryption Keys stores, audit logs mechanisms emails, and any other information pertaining to the company or company users and customers.
The procedures are also defined together with compliance experts in our Quality and Security Management Systems which have been certified according to the ISO 9001 and IS0 27001 standards.
Each access to PHI (both via API and administration tools) is subject to authentication and authorization procedures according to best technical and system administration techniques.
The access to the data via the API is performed according to permission policies which are define a method which is granular, tracked and transparent to the end-user. Permissions are documented on: docs.chino.io.
The access to the data via administration tools is performed according to industry standards where each component of the system (databases, VMs, key managers) are protected by passwords and access rights.
The access to the PHI both via the API and the administration tools is logged and the audit trail is hashed and encrypted according to best security stnadard in such a way that no more modifications are permitted.
Chino.io is a cyber-security company which delivers its know-how and best practices into the digital health sector. Chino.io applies Privacy and Security by Design principles, and constantly monitors its softwares and the offered service.
As described above, the access to the PHI is logged and the audit trail is hashed and encrypted according to best security stnadard in such a way that no more modifications are permitted.
Chino.io uses state-of-the-art password managers as part of its security procedures, where the team has the ability to update and monitor passwords, and revoke them as part of the disposal procedures.
The Chino.io response and reporting procedures are documented into its Quality and Security Management Systems, which has been certified according to the ISO 9001 and 27001 standards by third party auditors.
In addition Chino.io applies the legal requirements related to the incident response procedures which includes the Breach Notification procedure and remedy procedures to recover the initial state.
Following the state-of-the-art quality and security management procedures Chino.io applies daily backups of all users data and periodically checks their integrity by performing recovery tests.
In addition, the health data storage is implemented on Amazon AWS RDS service which provides by default backup procedures.
The testing recovery plans is documented and performed according to ISO 9001 standards, which are certified by a third party certification institute.
The criticality analysis is core for our system functioning since no single point of failuare is allowed in our service. To deliver highest Service Level Agreements and high availability even in case of incidents Chino.io constantly updates and improves its architecture and service.
Our security rules and practices are documented and certified by a third-party certification institute according to the ISO 27001 standard.
The certification process includes yearly reviews by the certification institute as part of the continuos improvement startegy.
In addition Chino.io ensures compliance with regulations such as NIS, reccomendations by institutions like Article 29 Working Party, agencies like ENISA, or security standards like OWASP. All those entities define and constantly update security guidelines and legal requirements.
Chino.io provides written contracts (Business Associate Agreements) clarifying its liabilities and duties to protect PHI, users' data and their confidentiality.
In addition, the Service Level Agreements and service availability is clearly defined in the Chino.io contract following the best standards adopted by cloud service providers.
§ 164.310(a)(1): “Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.”
Chino.io does not have physical facilities.
The team has access to the cloud infrastructure only via password-protected electronic methods.
Legal Requirement HIPAA Definition & Specifications
§ 164.310(b): “Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.”
Each workstation is protected by passwords and each Chino.io employee has limited privileges which are adequate to its role and duties.
§ 164.310(c): “Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.”
The storage of PHI is done only on our cloud infrastructure, and always in an encrypted format. In addition each workstation is password-protected with limited access to the infrastructure, which reduces at minimum the possibility to violate the perimeters.
§ 164.310(d)(1): “Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information, into and out of a facility, and the movement of these items within the facility.”
The storage of PHI is done only on our cloud infrastructure, and always in an encrypted format.
As described in previous sections, the logging and data backups procedures apply only to the access to the cloud infrastructure and data. Both functionalities are implemented according to best quality and security standards, which are certified in our ISO 9001 and 27001 procedures and documentation.
§ 164.304: Assure “the ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource.
Every user (both internal employees accessing via admin tools and application users accessing to Chino.io via API) have unique identiferiers which allow Chino.io to monitor, track and log in a non-modifiable manner the operations (read, write, update, delete, transfer rights) on data.
Each record on Chino.io is encrypted using AES 265 encryption algorithm, while the encryption keys are stored in a separate location, following the concepts of software based encryption modules.
One of the core features and engineering tasks of Chino.io is the indexing of certain documents' fields for search operations.
§ 164.312(b): “Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”
The Chino.io service is constantly monitored by different services which detect both errors and behavioral anomalies like potential security attacks. Notifications in real-time are sent via comunication channels among the team members.
§ 164.304: Grant that “the property that data or information have not been altered or destroyed in an unauthorized manner.”
Chino.io implements and offers to its customers the possibility to define and control very granular permissions over resources: documents, schemas, repositories. Permissions define CRUDA - Create, Read, Update, Delete and Administer actions over a resource The Administer consists also of transferring the rights to another Chino.io user.
This configuration allows Chino.io to track every operation on data and demonstrate, if needed, which actions a person committed over data.
§ 164.312(d): “Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.”
The identity management is core of the authentication mechanisms that Chino.io implements and that is offered via the API.
The authentication can be done either via OAuth2.0 protocol or via API Keys. These are the two standard protocols used by cloud providers to control the access and identity of their users.
§ 164.312(e)(1): “Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.”
Chino.io implements the HTTP Strict Transport Security (HSTS) Policy, which mandates the usage of HTTPS encrypted connections for each API call or operation over resources on Chino.io.
In addition, as mentioned previously, the data on Chino.io are encrypted at record level using the AES 265 encryption algorithm.