1

IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT technicians can look up how to log into each client's system when it needs work. These IT companies themselves are not storing their client's data, but their database contains information that could be used to grant full access to a client's data.

Do these databases need to meet the legal security requirements of the systems that they could be used to gain access to such as a server containing medical records (HIPPA) or financial information (PCI)?

Improve this question

1 Answer 1

Reset to default
1

One source of such a requirement would be contractual: A provides access to B pursuant to a contract, and the contract requires A to observe certain standards. A second source would be direct regulation, following certain statutes. HIPAA (in particular the Privacy Rule) applies to healthcare providers, but also "Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate", which includes "A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate", initially promulgated as a rule, and then authority to set rules delegated to the Office of Civil Rights. However, the PCI security standard is not federally mandated; it falls into the category of contractual mandates.

Improve this answer
1
  • Thanks, and am I right in understanding that access keys, credentials, and remote management software qualify as "provision of access to" under the HIPAA definition of Disclosure?
    – Nosajimiki
    Aug 27, 2019 at 19:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .