Click here to close now.


@CloudExpo Authors: Carmen Gonzalez, Cloud Best Practices Network, Liz McMillan, Pat Romanski, Kevin Jackson

Related Topics: @CloudExpo, Cloud Security

@CloudExpo: Blog Feed Post

Security in Cloud Computing for HIPAA Compliance

We are seeing a serious gap between healthcare companies’ security and compliance needs

At healthcare events throughout the world, we have met many health tech companies who are considering migrating to the cloud, but have serious concerns about protecting electronic protected health Information (e-PHI) and maintaining HIPAA compliance as they virtualize their environments.

We are seeing a serious gap between healthcare companies’ security and compliance needs, and the solutions offered by their cloud providers.

Below, a summary of the questions we are continually asked at shows, events, and meetings with healthcare professionals.

Cloud Computing Security Considerations

Q.  What cloud computing security considerations should healthcare companies examine?
HIPAA compliance is comprised of multiple technologies and processes. When it comes to data encryption, securing e-PHI that your company creates, receives, maintains or transmits electronically is critical in infrastructure clouds. Clouds obviously don’t have walls – which is why encryption has become the best practice for creating “mathematical walls” in the cloud.

Since your cloud project will have both servers and data in the cloud, you need a solution that:

  1. Has an “everything cloud” approach: No “gateways” or hardware required
  2. Maintains HIPAA/HITECH Compliance
  3. Ensures data security – going beyond a “check the box” approach
  4. Is simple, easy to use, flexible, and cost-effective

It is your responsibility to secure your sensitive patient data, to encrypt data at rest and in transit and, importantly, to ensure that only you (not even your cloud provider) control your encryption keys. This is both security common sense and also important from a regulatory point of view.

Q.  Is it possible to achieve “safe harbor” in cloud scenarios?
The Secretary of Health and Human Services published guidance on “technologies and methodologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals.” The guidance emphasizes that data encryption is not only a best practice for protecting privacy and security – it also provides a safe harbor to the organization in case of data loss.

Q.  How is the Porticor cloud encryption solution different?
Porticor did not re-invent the data encryption wheel.  We use the strongest industry standards for data encryption like AES.  Our system is unique, however, in how it handles the keys to your encrypted data.  Porticor is the only system that keeps control of encryption keys in the hands of the end customer while providing a pure cloud model – without any hardware requirements.

With Porticor, once your e-PHI is encrypted, our system splits the encryption key it into two parts (here’s how in 90 seconds).  One part stays within our system and one part, the “master key” stays with you at all times.  Both parts are required to access your data.  With this split-key encryption approach, Porticor ensures that only you control access to your data.  Your cloud provider cannot access it, Porticor cannot access it, and hackers cannot access it.  Only you control your data.  This is what makes the system HIPAA compliant while maintaining the “pure cloud” approach. You can read more about it here.

Q.  Does this kind of cloud security slow down performance?
No. We’ve gone to some length to keep performance top notch, by introducing efficient streaming. We also make sure that encryption happens inside your cloud account so there are no latency issues around network hops. You have a choice between a “Virtual Appliance” that you can bring up inside your own cloud account, and an “agent” that you can install on your own.

As a result in some use cases we actually speed you up a bit!  Detailed benchmarks are available here.

Q.  What does homomorphic encryption mean?
Homomorphic encryption is a technique that enables encrypting data, and keeping it encrypted even if it is used in calculations. As it relates to our system, Porticor homomorphically encrypts your master key before it enters the cloud, and it stays encrypted – never decrypted – when it is used in the cloud. This means your entire project works without anyone knowing your master key – not Porticor, not AWS, no computing element at all.  This way, you retain control of your key at all times.  Your key is safe even when it is in use in the cloud.

Q.  Which companies need Porticor’s cloud security?
If your company or its clients face regulations like HIPAA, PCI DSS, or many others – you need Porticor.

Q.  Which clouds are supported by Porticor?
You can use Porticor in any cloud scenario: public clouds (AWS, VMware, IBM, HP, etc.), private clouds (VMware again), or hybrid scenarios.

Q.  How do I get started?
You can try it for free here.  If you have any questions, contact us.

The post Security in Cloud Computing for HIPAA Compliance appeared first on Porticor Cloud Security.

Read the original blog entry...

More Stories By Gilad Parann-Nissany

Gilad Parann-Nissany, Founder and CEO at Porticor is a pioneer of Cloud Computing. He has built SaaS Clouds for medium and small enterprises at SAP (CTO Small Business); contributing to several SAP products and reaching more than 8 million users. Recently he has created a consumer Cloud at - a cloud operating system that delighted hundreds of thousands of users while providing browser-based and mobile access to data, people and a variety of cloud-based applications. He is now CEO of Porticor, a leader in Virtual Privacy and Cloud Security.

@CloudExpo Stories
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driv...
SYS-CON Events announced today that Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, will keynote at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
There are many considerations when moving applications from on-premise to cloud. It is critical to understand the benefits and also challenges of this migration. A successful migration will result in lower Total Cost of Ownership, yet offer the same or higher level of robustness. Migration to cloud shifts computing resources from your data center, which can yield significant advantages provided that the cloud vendor an offer enterprise-grade quality for your application.
Developing software for the Internet of Things (IoT) comes with its own set of challenges. Security, privacy, and unified standards are a few key issues. In addition, each IoT product is comprised of at least three separate application components: the software embedded in the device, the backend big-data service, and the mobile application for the end user's controls. Each component is developed by a different team, using different technologies and practices, and deployed to a different stack/...
SYS-CON Events announced today that DataClear Inc. will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. The DataClear ‘BlackBox’ is the only solution that moves your PC, browsing and data out of the United States and away from prying (and spying) eyes. Its solution automatically builds you a clean, on-demand, virus free, new virtual cloud based PC outside of the United States, and wipes it clean...
SYS-CON Events announced today that Machkey International Company will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Machkey provides advanced connectivity solutions for just about everyone. Businesses or individuals, Machkey is dedicated to provide high-quality and cost-effective products to meet all your needs.
Containers have changed the mind of IT in DevOps. They enable developers to work with dev, test, stage and production environments identically. Containers provide the right abstraction for microservices and many cloud platforms have integrated them into deployment pipelines. DevOps and Containers together help companies to achieve their business goals faster and more effectively.
Containers are revolutionizing the way we deploy and maintain our infrastructures, but monitoring and troubleshooting in a containerized environment can still be painful and impractical. Understanding even basic resource usage is difficult - let alone tracking network connections or malicious activity. In his session at DevOps Summit, Gianluca Borello, Sr. Software Engineer at Sysdig, will cover the current state of the art for container monitoring and visibility, including pros / cons and li...
The web app is agile. The REST API is agile. The testing and planning are agile. But alas, data infrastructures certainly are not. Once an application matures, changing the shape or indexing scheme of data often forces at best a top down planning exercise and at worst includes schema changes that force downtime. The time has come for a new approach that fundamentally advances the agility of distributed data infrastructures. Come learn about a new solution to the problems faced by software organ...
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new da...
Achim Weiss is Chief Executive Officer and co-founder of ProfitBricks. In 1995, he broke off his studies to co-found the web hosting company "Schlund+Partner." The company "Schlund+Partner" later became the 1&1 web hosting product line. From 1995 to 2008, he was the technical director for several important projects: the largest web hosting platform in the world, the second largest DSL platform, a video on-demand delivery network, the largest eMail backend in Europe, and a universal billing syste...
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
The IoT is upon us, but today’s databases, built on 30-year-old math, require multiple platforms to create a single solution. Data demands of the IoT require Big Data systems that can handle ingest, transactions and analytics concurrently adapting to varied situations as they occur, with speed at scale. In his session at @ThingsExpo, Chad Jones, chief strategy officer at Deep Information Sciences, will look differently at IoT data so enterprises can fully leverage their IoT potential. He’ll sha...
In today's digital world, change is the one constant. Disruptive innovations like cloud, mobility, social media, and the Internet of Things have reshaped the market and set new standards in customer expectations. To remain competitive, businesses must tap the potential of emerging technologies and markets through the rapid release of new products and services. However, the rigid and siloed structures of traditional IT platforms and processes are slowing them down – resulting in lengthy delivery ...
The modern software development landscape consists of best practices and tools that allow teams to deliver software in a near-continuous manner. By adopting a culture of automation, measurement and sharing, the time to ship code has been greatly reduced, allowing for shorter release cycles and quicker feedback from customers and users. Still, with all of these tools and methods, how can teams stay on top of what is taking place across their infrastructure and codebase? Hopping between services a...
As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ability. Many are unable to effectively engage and inspire, creating forward momentum in the direction of desired change. Renowned for its approach to leadership and emphasis on their people, organizations increasingly look to our military for insight into these challenges.
DevOps and Continuous Delivery software provider XebiaLabs has announced it has been selected to join the Amazon Web Services (AWS) DevOps Competency partner program. The program is designed to highlight software vendors like XebiaLabs who have demonstrated technical expertise and proven customer success in DevOps and specialized solution areas like Continuous Delivery. DevOps Competency Partners provide solutions to, or have deep experience working with AWS users and other businesses to help t...
Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
Overgrown applications have given way to modular applications, driven by the need to break larger problems into smaller problems. Similarly large monolithic development processes have been forced to be broken into smaller agile development cycles. Looking at trends in software development, microservices architectures meet the same demands. Additional benefits of microservices architectures are compartmentalization and a limited impact of service failure versus a complete software malfunction....