Does HiPAA allow for the use of cloud services to store encrypted backups?

Question

Considering a service allows for the communication of PHI without persistent storage.

If the user takes responsibility for storing their own data, and they choose to store it in their google cloud storage, would this be an acceptable under HIPAA?

For example:

A user wants to send a message to another user.

The service establishes an encrypted connection directly between their two devices. The server stores only contact information and no PHI whatsoever. The server does not participate in the communication once the connection is established and does not even forward the messages. (It would be helpful to know if the service might be in violation if the servers did in fact forward the messages).

The data is stored, encrypted, on each user's devices.

If that encrypted data is then stored on a third party cloud storage service, like iCloud or Google drive, then would the service be in violation of HIPAA?

Answer 1

HIPAA applies only to particular kinds of entities(see https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/HIPAA-ACA/AreYouaCoveredEntity.html); such as Health Plans, Health Care Providers, Clearinghouses, and their Business Associates.

If you are talking about a person storing his or her own health information and sharing it with others by his or her own choice, then HIPAA does not apply.

If by "user" you mean a provider or another covered entity, then HIPAA does permit storing PHI in a cloud-based system, provided that proper security is in place, including encryption, and provided that only people with legitimate reason to access the information have access, and this is enforced by appropriate legal agreements as well as by technical measures.