Welcome!

@CloudExpo Authors: Liz McMillan, Yeshim Deniz, Elizabeth White, Pat Romanski, Zakia Bouachraoui

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Feed Post

Security in Cloud Computing for HIPAA Compliance

We are seeing a serious gap between healthcare companies’ security and compliance needs

At healthcare events throughout the world, we have met many health tech companies who are considering migrating to the cloud, but have serious concerns about protecting electronic protected health Information (e-PHI) and maintaining HIPAA compliance as they virtualize their environments.

We are seeing a serious gap between healthcare companies’ security and compliance needs, and the solutions offered by their cloud providers.

Below, a summary of the questions we are continually asked at shows, events, and meetings with healthcare professionals.

Cloud Computing Security Considerations

Q.  What cloud computing security considerations should healthcare companies examine?
HIPAA compliance is comprised of multiple technologies and processes. When it comes to data encryption, securing e-PHI that your company creates, receives, maintains or transmits electronically is critical in infrastructure clouds. Clouds obviously don’t have walls – which is why encryption has become the best practice for creating “mathematical walls” in the cloud.

Since your cloud project will have both servers and data in the cloud, you need a solution that:

  1. Has an “everything cloud” approach: No “gateways” or hardware required
  2. Maintains HIPAA/HITECH Compliance
  3. Ensures data security – going beyond a “check the box” approach
  4. Is simple, easy to use, flexible, and cost-effective

It is your responsibility to secure your sensitive patient data, to encrypt data at rest and in transit and, importantly, to ensure that only you (not even your cloud provider) control your encryption keys. This is both security common sense and also important from a regulatory point of view.

Q.  Is it possible to achieve “safe harbor” in cloud scenarios?
The Secretary of Health and Human Services published guidance on “technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.” The guidance emphasizes that data encryption is not only a best practice for protecting privacy and security – it also provides a safe harbor to the organization in case of data loss.

Q.  How is the Porticor cloud encryption solution different?
Porticor did not re-invent the data encryption wheel.  We use the strongest industry standards for data encryption like AES.  Our system is unique, however, in how it handles the keys to your encrypted data.  Porticor is the only system that keeps control of encryption keys in the hands of the end customer while providing a pure cloud model – without any hardware requirements.

With Porticor, once your e-PHI is encrypted, our system splits the encryption key it into two parts (here’s how in 90 seconds).  One part stays within our system and one part, the “master key” stays with you at all times.  Both parts are required to access your data.  With this split-key encryption approach, Porticor ensures that only you control access to your data.  Your cloud provider cannot access it, Porticor cannot access it, and hackers cannot access it.  Only you control your data.  This is what makes the system HIPAA compliant while maintaining the “pure cloud” approach. You can read more about it here.

Q.  Does this kind of cloud security slow down performance?
No. We’ve gone to some length to keep performance top notch, by introducing efficient streaming. We also make sure that encryption happens inside your cloud account so there are no latency issues around network hops. You have a choice between a “Virtual Appliance” that you can bring up inside your own cloud account, and an “agent” that you can install on your own.

As a result in some use cases we actually speed you up a bit!  Detailed benchmarks are available here.

Q.  What does homomorphic encryption mean?
Homomorphic encryption is a technique that enables encrypting data, and keeping it encrypted even if it is used in calculations. As it relates to our system, Porticor homomorphically encrypts your master key before it enters the cloud, and it stays encrypted – never decrypted – when it is used in the cloud. This means your entire project works without anyone knowing your master key – not Porticor, not AWS, no computing element at all.  This way, you retain control of your key at all times.  Your key is safe even when it is in use in the cloud.

Q.  Which companies need Porticor’s cloud security?
If your company or its clients face regulations like HIPAA, PCI DSS, or many others – you need Porticor.

Q.  Which clouds are supported by Porticor?
You can use Porticor in any cloud scenario: public clouds (AWS, VMware, IBM, HP, etc.), private clouds (VMware again), or hybrid scenarios.

Q.  How do I get started?
You can try it for free here.  If you have any questions, contact us.

The post Security in Cloud Computing for HIPAA Compliance appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at G.ho.st - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

CloudEXPO Stories
Modern software design has fundamentally changed how we manage applications, causing many to turn to containers as the new virtual machine for resource management. As container adoption grows beyond stateless applications to stateful workloads, the need for persistent storage is foundational - something customers routinely cite as a top pain point. In his session at @DevOpsSummit at 21st Cloud Expo, Bill Borsari, Head of Systems Engineering at Datera, explored how organizations can reap the benefits of the cloud without losing performance as containers become the new paradigm.
In this presentation, you will learn first hand what works and what doesn't while architecting and deploying OpenStack. Some of the topics will include:- best practices for creating repeatable deployments of OpenStack- multi-site considerations- how to customize OpenStack to integrate with your existing systems and security best practices.
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and GM, discussed how clients in this new era of innovation can apply data, technology, plus human ingenuity to springboard to advance new business value and opportunities.
The current age of digital transformation means that IT organizations must adapt their toolset to cover all digital experiences, beyond just the end users’. Today’s businesses can no longer focus solely on the digital interactions they manage with employees or customers; they must now contend with non-traditional factors. Whether it's the power of brand to make or break a company, the need to monitor across all locations 24/7, or the ability to proactively resolve issues, companies must adapt to the new world.
DXWorldEXPO LLC announced today that ICC-USA, a computer systems integrator and server manufacturing company focused on developing products and product appliances, will exhibit at the 22nd International CloudEXPO | DXWorldEXPO. DXWordEXPO New York 2018, colocated with CloudEXPO New York 2018 will be held November 11-13, 2018, in New York City. ICC is a computer systems integrator and server manufacturing company focused on developing products and product appliances to meet a wide range of computational needs for many industries. Their solutions provide benefits across many environments, such as datacenter deployment, HPC, workstations, storage networks and standalone server installations. ICC has been in business for over 23 years and their phenomenal range of clients include multinational corporations, universities, and small businesses.