Datica Compliance

> Policy Docs
CLOSE MENU

Introduction

Datica Health, Inc (“Datica”) is committed to ensuring the confidentiality, privacy, integrity, and availability of all electronic protected health information (ePHI) it receives, maintains, processes and/or transmits on behalf of its Customers. As providers of compliant, hosted infrastructure used by health technology vendors, developers, designers, agencies, custom development shops, and enterprises, Datica strives to maintain compliance, proactively address information security, mitigate risk for its Customers, and assure known breaches are completely and effectively communicated in a timely manner. The following documents address core policies used by Datica to maintain compliance and assure the proper protections of infrastructure used to store, process, and transmit ePHI for Datica Customers.

Datica provides secure and compliant cloud-based software. This hosted software falls into two broad categories: 1) Platform as a Service (Paas) and 2) Platform Add-ons. These Categories are cited throughout polices as Customers in each category inherit different policies, procedures, and obligations from Datica.

Platform as a Service (PaaS)

PaaS Customers utilize hosted software and infrastructure from Datica to deploy, host, and scale custom developed applications and configured databases. These customers are deployed into compliant containers run on systems secured and managed by Datica. Datica does not have insight or access into application level data of PaaS Customers and, as such, does not have the ability to secure or manage risk associated with application level vulnerabilities and security weaknesses. Datica makes every effort to reduce the risk of unauthorized disclosure, access, and/or breach of PaaS Customer data through network (firewalls, dedicated IP spaces, etc) and server settings (encryption at rest and in transit, OSSEC throughout the Platform, etc).

PaaS Customers can opt for a list of Services from Datica, which include Backup Service, Logging Service, IDS Service, and Disaster Recovery Service. These services are not standard and PaaS Customers must sign up for them in order for Datica to manage these areas of security and compliance.

Platform Add-ons

Add-ons are compliant API-driven services that are offered as part of the Datica Platform. These services currently include our Backend as a Service and secure Messaging Service. With Add-ons, Datica has access to data models and manages all application level configurations and security.

In the future there may be 3rd party Add-on services available as part of the Datica Platform. These 3rd party, or Partner, Services will be fully reviewed by Datica to assure they do not have a negative impact on Datica’s information security and compliance posture.

Compliance Inheritance

Datica provides compliant hosted software infrastructure for its Customers. Datica has been through a HIPAA compliance audit by a national, 3rd party compliance firm, to validate and map organizational policies and technical settings to HIPAA rules. Datica, as a company, and its technology, is HITRUST Certified. Datica’s infrastructure at Rackspace is HITRUST Certified and certification for AWS, Azure, and SoftLayer are in progress.

Datica signs business associate agreements (BAAs) with its Customers. These BAAs outline Datica obligations and Customer obligations, as well as liability in the case of a breach. In providing infrastructure and managing security configurations that are a part of the technology requirements that exist in HIPAA and HITRUST, as well as future compliance frameworks, Datica manages various aspects of compliance for Customers. The aspects of compliance that Datica manages for Customers are inherited by Customers, and Datica assumes the risk associated with those aspects of compliance. In doing so, Datica helps Customers achieve and maintain compliance, as well as mitigates Customers risk.

Certain aspects of compliance cannot be inherited. Because of this, Datica Customers, in order to achieve full compliance or HITRUST Certification, must implement certain organizational policies. These policies and aspects of compliance fall outside of the services and obligations of Datica.

Below are mappings of HIPAA Rules to Datica controls and a mapping of what Rules are inherited by Customers, both Platform Customers and Add-on Customers.

Datica Organizational Concepts

The physical infrastructure environment is hosted at Rackspace, Amazon Web Services (AWS), Microsoft Azure, and IBM SoftLayer. The network components and supporting network infrastructure are contained within the Rackspace, AWS, Azure, and SoftLayer infrastructures and managed by Rackspace, AWS, Microsoft, and IBM (respectively). Datica does not have physical access into the network components. The Datica environment consists of Cisco firewalls; nginx web servers; Java, Python, and Go application servers; Percona and PostgreSQL database servers; Logstash logging servers; Linux Ubuntu monitoring servers; Windows Server virtual machines; Chef and Salt configuration management servers; OSSEC IDS services; Docker containers; and developer tool servers running on Linux Ubuntu.

Within the Datica Platform on Rackspace, AWS, Azure, and SoftLayer, all data transmission is encrypted and all hard drives are encrypted so data at rest is also encrypted; this applies to all servers - those hosting Docker containers, databases, APIs, log servers, etc. Datica assumes all data may contain ePHI, even though our Risk Assessment does not indicate this is the case, and provides appropriate protections based on that assumption.

In the case of PaaS Customers, it is the responsibility of the Customer to restrict, secure, and assure the privacy of all ePHI data at the Application Level, as this is not under the control or purview of Datica.

The data and network segmentation mechanism differs depending on the primitives offered by the underlying cloud provider infrastructure:

The result of segmentation strategies employed by Datica effectively create RFC 1918, or dedicated, private segmented and separated networks and IP spaces, for each PaaS Customer and for Platform Add-ons.

Additionally, IPtables is used on each each server for logical segmentation. IPtables is configured to restrict access to only justified ports and protocols. Datica has implemented strict logical access controls so that only authorized personnel are given access to the internal management servers. The environment is configured so that data is transmitted from the load balancers to the application servers over an SSL encrypted session.

In the case of Platform Add-ons, once the data is received from the application server, a series of Application Programming Interface (API) calls is made to the database servers where the ePHI resides. The ePHI is separated into PostgreSQL and Percona databases through programming logic built, so that access to one database server will not present you with the full ePHI spectrum.

The bastion host, nginx web server, and application servers are externally facing and accessible via the Internet. The database servers, where the ePHI resides, are located on the internal Datica network and can only be accessed directly over an SSH connection through the bastion host. The access to the internal database is restricted to a limited number of personnel and strictly controlled to only those personnel with a business justified reason. Remote access to the internal servers is not accessible except through the load balancers and bastion host.

All Platform Add-ons and operating systems are tested end-to-end for usability, security and impact prior to deployment to production.

Version Control

Policies were last updated May 10th, 2016.

HIPAA Inheritance for PaaS Customers

Administrative Controls HIPAA Rule Datica Control Inherited
Security Management Process - 164.308(a)(1)(i) Risk Management Policy Yes
Assigned Security Responsibility - 164.308(a)(2) Roles Policy Partially
Workforce Security - 164.308(a)(3)(i) Employee Policies Partially
Information Access Management - 164.308(a)(4)(i) System Access Policy Yes
Security Awareness and Training - 164.308(a)(5)(i) Employee Policy No
Security Incident Procedures - 164.308(a)(6)(i) IDS Policy Yes
Contingency Plan - 164.308(a)(7)(i) Disaster Recovery Policy Yes
Evaluation - 164.308(a)(8) Auditing Policy Yes
Physical Safeguards HIPAA Rule Datica Control Inherited
Facility Access Controls - 164.310(a)(1) Facility and Disaster Recovery Policies Yes
Workstation Use - 164.310(b) System Access, Approved Tools, and Employee Policies Partially
Workstation Security - 164.310(‘c’) System Access, Approved Tools, and Employee Policies Partially
Device and Media Controls - 164.310(d)(1) Disposable Media and Data Management Policies Yes
Technical Safeguards HIPAA Rule Datica Control Inherited
Access Control - 164.312(a)(1) System Access Policy Partially
Audit Controls - 164.312(b) Auditing Policy Yes (optional)
Integrity - 164.312('c’)(1) System Access, Auditing, and IDS Policies Yes (optional)
Person or Entity Authentication - 164.312(d) System Access Policy Yes
Transmission Security - 164.312(e)(1) System Access and Data Management Policy Yes
Organizational Requirements HIPAA Rule Datica Control Inherited
Business Associate Contracts or Other Arrangements - 164.314(a)(1)(i) Business Associate Agreements and 3rd Parties Policies Partially
Policies and Procedures and Documentation Requirements HIPAA Rule Datica Control Inherited
Policies and Procedures - 164.316(a) Policy Management Policy Partially
Documentation - 164.316(b)(1)(i) Policy Management Policy Partially
HITECH Act - Security Provisions HIPAA Rule Datica Control Inherited
Notification in the Case of Breach - 13402(a) and (b) Breach Policy Partially
Timelines of Notification - 13402(d)(1) Breach Policy Partially
Content of Notification - 13402(f)(1) Breach Policy Partially

HIPAA Inheritance for Platform Add-on Customers

Administrative Controls HIPAA Rule Datica Control Inherited
Security Management Process - 164.308(a)(1)(i) Risk Management Policy Yes
Assigned Security Responsibility - 164.308(a)(2) Roles Policy Partially
Workforce Security - 164.308(a)(3)(i) Employee Policies Partially
Information Access Management - 164.308(a)(4)(i) System Access Policy Yes
Security Awareness and Training - 164.308(a)(5)(i) Employee Policy No
Security Incident Procedures - 164.308(a)(6)(i) IDS Policy Yes
Contingency Plan - 164.308(a)(7)(i) Disaster Recovery Policy Yes
Evaluation - 164.308(a)(8) Auditing Policy Yes
Physical Safeguards HIPAA Rule Datica Control Inherited
Facility Access Controls - 164.310(a)(1) Facility and Disaster Recovery Policies Yes
Workstation Use - 164.310(b) System Access, Approved Tools, and Employee Policies Partially
Workstation Security - 164.310(‘c’) System Access, Approved Tools, and Employee Policies Partially
Device and Media Controls - 164.310(d)(1) Disposable Media and Data Management Policies Yes
Technical Safeguards HIPAA Rule Datica Control Inherited
Access Control - 164.312(a)(1) System Access Policy Yes
Audit Controls - 164.312(b) Auditing Policy Yes
Integrity - 164.312('c’)(1) System Access, Auditing, and IDS Policies Yes
Person or Entity Authentication - 164.312(d) System Access Policy Yes
Transmission Security - 164.312(e)(1) System Access and Data Management Policy Yes
Organizational Requirements HIPAA Rule Datica Control Inherited
Business Associate Contracts or Other Arrangements - 164.314(a)(1)(i) Business Associate Agreements and 3rd Parties Policies Partially
Policies and Procedures and Documentation Requirements HIPAA Rule Datica Control Inherited
Policies and Procedures - 164.316(a) Policy Management Policy Partially
Documentation - 164.316(b)(1)(i) Policy Management Policy Partially
HITECH Act - Security Provisions HIPAA Rule Datica Control Inherited
Notification in the Case of Breach - 13402(a) and (b) Breach Policy Yes
Timelines of Notification - 13402(d)(1) Breach Policy Yes
Content of Notification - 13402(f)(1) Breach Policy Yes

Policy Management Policy

Datica implements policies and procedures to maintain compliance and integrity of data. The Security Officer and Privacy Officer are responsible for maintaining policies and procedures and assuring all Datica workforce members, business associates, customers, and partners are adherent to all applicable policies. Previous versions of policies are retained to assure ease of finding policies at specific historic dates in time.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Maintenance of Policies

  1. All policies are stored and up to date to maintain Datica compliance with HIPAA, HITRUST, NIST, and other relevant standards. Updates and version control are done similar to source code control.
  2. Policy update requests can be made by any workforce member at any time. Furthermore, all policies are reviewed annually by both the Security and Privacy Officer to assure they are accurate and up-to-date.
  3. Edits and updates made by appropriate and authorized workforce members are done on their own versions, or branches. These changes are only merged back into final, or master, versions by the Privacy or Security Officer, similar to a pull request. All changes are linked to workforce personnel who made them and the Officer who accepted them.
  4. All policies are made accessible to all Datica workforce members. The current master policies are published here.
    • Changes can be requested to policies using this form.
    • Once the change has been approved to a Datica Policy we implement the policy change using Chef/Salt. The process for that is spelled out in the Datica Configuration Management Policy.
    • Changes are automatically communicated to all Datica team members through integrations between Github and Slack that log all Github policy channels to a dedicated Datica Slack Channel.
  5. All policies, and associated documentation, are retained for 6 years from the date of its creation or the date when it last was in effect, whichever is later
    1. Version history of all Datica policies is done via Github.
    2. Backup storage of all policies is done with Box.
  6. The policies and information security policies are reviewed and audited annually. Issues that come up as part of this process are reviewed by Datica management to assure all risks and potential gaps are mitigated and/or fully addressed. The policy review form can be found here.
  7. Datica utilizes the HITRUST MyCSF framework to track compliance with the HITRUST CSF on an annual basis. Datica also tracks compliance with HIPAA and publishes results here.

Additional documentation related to maintenance of policies is outlined in the Security officers responsibilities.

Risk Management Policy

This policy establishes the scope, objectives, and procedures of Datica’s information security risk management process. The risk management process is intended to support and protect the organization and its ability to fulfill its mission.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Risk Management Policies

  1. It is the policy of Datica to conduct thorough and timely risk assessments of the potential threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) (and other confidential and proprietary electronic information) it stores, transmits, and/or processes for its Customers and to develop strategies to efficiently and effectively mitigate the risks identified in the assessment process as an integral part of the Datica’s information security program.
  2. Risk analysis and risk management are recognized as important components of Datica’s corporate compliance program and information security program in accordance with the Risk Analysis and Risk Management implementation specifications within the Security Management standard and the evaluation standards set forth in the HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A), 164.308(a)(1)(ii)(B), 164.308(a)(1)(i), and 164.308(a)(8).
    1. Risk assessments are done throughout product life cycles:
    2. Before the integration of new system technologies and before changes are made to Datica physical safeguards; and
      • These changes do not include routine updates to existing systems, deployments of new systems created based on previously configured systems, deployments of new Customers, or new code developed for operations and management of the Datica Platform.
    3. While making changes to Datica physical equipment and facilities that introduce new, untested configurations.
    4. Datica performs periodic technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting the security of ePHI.
  3. Datica implements security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to:
    1. Ensure the confidentiality, integrity, and availability of all ePHI Datica receives, maintains, processes, and/or transmits for its Customers;
    2. Protect against any reasonably anticipated threats or hazards to the security or integrity of Customer ePHI;
    3. Protect against any reasonably anticipated uses or disclosures of Customer ePHI that are not permitted or required; and
    4. Ensure compliance by all workforce members.
  4. Any risk remaining (residual) after other risk controls have been applied, requires sign off by the senior management and Datica’s Security Officer.
  5. All Datica workforce members are expected to fully cooperate with all persons charged with doing risk management work, including contractors and audit personnel. Any workforce member that violates this policy will be subject to disciplinary action based on the severity of the violation, as outlined in the Datica Roles Policy.
  6. The implementation, execution, and maintenance of the information security risk analysis and risk management process is the responsibility of Datica’s Security Officer (or other designated employee), and the identified Risk Management Team.
  7. All risk management efforts, including decisions made on what controls to put in place as well as those to not put into place, are documented and the documentation is maintained for six years.

Risk Management Procedures

Risk Assessment: The intent of completing a risk assessment is to determine potential threats and vulnerabilities and the likelihood and impact should they occur. The output of this process helps to identify appropriate controls for reducing or eliminating risk.

Risk Mitigation: Risk mitigation involves prioritizing, evaluating, and implementing the appropriate risk-reducing controls recommended from the Risk Assessment process to ensure the confidentiality, integrity and availability of Datica Platform ePHI. Determination of appropriate controls to reduce risk is dependent upon the risk tolerance of the organization consistent with its goals and mission.

Risk Management Schedule: The two principle components of the risk management process - risk assessment and risk mitigation - will be carried out according to the following schedule to ensure the continued adequacy and continuous improvement of Datica’s information security program:

Process Documentation

Maintain documentation of all risk assessment, risk management, and risk mitigation efforts for a minimum of six years.

Roles Policy

Datica has a Security Officer [164.308(a)(2)] and Privacy Officer [164.308(a)(2)] appointed to assist in maintaining and enforcing safeguards towards compliance. The responsibilities associated with these roles are outlined below.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Privacy Officer

The Privacy Officer is responsible for assisting with compliance and security training for workforce members, assuring organization remains in compliance with evolving compliance rules, and helping the Security Officer in his responsibilities.

  1. Provides annual training to all workforce members of established policies and procedures as necessary and appropriate to carry out their job functions, and documents the training provided.
  2. Assists in the administration and oversight of business associate agreements.
  3. Manage relationships with customers and partners as those relationships affect security and compliance of ePHI.
  4. Assist Security Officer as needed.

The current Datica Privacy Officer is Travis Good (travis@datica.com).

Workforce Training Responsibilities

  1. The Privacy Officer facilitates the training of all workforce members as follows:

    1. New workforce members within their first month of employment;
    2. Existing workforce members annually;
    3. Existing workforce members whose functions are affected by a material change in the policies and procedures, within a month after the material change becomes effective;
    4. Existing workforce members as needed due to changes in security and risk posture of Datica.
  2. The Security Officer or designee maintains documentation of the training session materials and attendees for a minimum of six years.

  3. The training session focuses on, but is not limited to, the following subjects defined in Datica’s security policies and procedures:

    1. HIPAA Privacy, Security, and Breach notification rules;
    2. HITRUST Common Security Framework;
    3. NIST Security Rules;
    4. Risk Management procedures and documentation;
    5. Auditing. Datica may monitor access and activities of all users;
    6. Workstations may only be used to perform assigned job responsibilities;
    7. Users may not download software onto Datica’s workstations and/or systems without prior approval from the Security Officer;
    8. Users are required to report malicious software to the Security Officer immediately;
    9. Users are required to report unauthorized attempts, uses of, and theft of Datica’s systems and/or workstations;
    10. Users are required to report unauthorized access to facilities
    11. Users are required to report noted log-in discrepancies (i.e. application states users last log-in was on a date user was on vacation;
    12. Users may not alter ePHI maintained in a database, unless authorized to do so by a Datica Customer;
    13. Users are required to understand their role in Datica’s contingency plan;
    14. Users may not share their user names nor passwords with anyone;
    15. Requirements for users to create and change passwords;
    16. Users must set all applications that contain or transmit ePHI to automatically log off after “X” minutes of inactivity;
    17. Supervisors are required to report terminations of workforce members and other outside users;
    18. Supervisors are required to report a change in a users title, role, department, and/or location;
    19. Procedures to backup ePHI;
    20. Procedures to move and record movement of hardware and electronic media containing ePHI;
    21. Procedures to dispose of discs, CDs, hard drives, and other media containing ePHI;
    22. Procedures to re-use electronic media containing ePHI;
    23. SSH key and sensitive document encryption procedures.

Security Officer

The Security Officer is responsible for facilitating the training and supervision of all workforce members [164.308(a)(3)(ii)(A) and 164.308(a)(5)(ii)(A)], investigation and sanctioning of any workforce member that is in violation of Datica security policies and non-compliance with the security regulations [164.308(a)(1)(ii)©], and writing, implementing, and maintaining all polices, procedures, and documentation related to efforts toward security and compliance [164.316(a-b)].

The current Datica Security Officer is Adam Leko (adam@datica.com).

Organizational Responsibilities

The Security Officer, in collaboration with the Privacy Officer, is responsible for facilitating the development, implementation, and oversight of all activities pertaining to Datica’s efforts to be compliant with the HIPAA Security Regulations, HITRUST CSF, and any other security and compliance frameworks. The intent of the Security Officer Responsibilities is to maintain the confidentiality, integrity, and availability of ePHI. These organizational responsibilities include, but are not limited to the following:

  1. Oversees and enforces all activities necessary to maintain compliance and verifies the activities are in alignment with the requirements.

  2. Helps to established and maintain written policies and procedures to comply with the Security rule and maintains them for six years from the date of creation or date it was last in effect, whichever is later.

  3. Updates policies and procedures as necessary and appropriate to maintain compliance and maintains changes made for six years from the date of creation or date it was last in effect, whichever is later.

  4. Facilitates audits to validate compliance efforts throughout the organization.

  5. Documents all activities and assessments completed to maintain compliance and maintains documentation for six years from the date of creation or date it was last in effect, whichever is later.

  6. Provides copies of the policies and procedures to management, customers, and partners, and has them available to review by all other workforce members to which they apply.

  7. Annually, and as necessary, reviews and updates documentation to respond to environmental or operational changes affecting the security and risk posture of ePHI stored, transmitted, or processed within Datica infrastructure.

  8. Develops and provides periodic security updates and reminder communications for all workforce members.

  9. Implements procedures for the authorization and/or supervision of workforce members who work with ePHI or in locations where it may be accessed.

  10. Maintains a program promoting workforce members to report non-compliance with policies and procedures.

    1. Promptly, properly, and consistently investigates and addresses reported violations and takes steps to prevent recurrence.
    2. Applies consistent and appropriate sanctions against workforce members who fail to comply with the security policies and procedures of Datica.
    3. Mitigates, to the extent practicable, any harmful effect known to Datica of a use or disclosure of ePHI in violation of Datica’s policies and procedures, even if effect is the result of actions of Datica business associates, customers, and/or partners.
  11. Reports security efforts and incidents to administration immediately upon discovery. Responsibilities in the case of a known ePHI breach are documented in the Datica Breach Policy.

  12. The Security Officer facilitates the communication of security updates and reminders to all workforce members to which it pertains. Examples of security updates and reminders include, but are not limited to:

    1. Latest malicious software or virus alerts;
    2. Datica’s requirement to report unauthorized attempts to access ePHI;
    3. Changes in creating or changing passwords;
    4. Additional security-focused training is provided to all workforce members by the Security Officer. This training includes, but is not limited to:
    5. Data backup plans;
    6. System auditing procedures;
    7. Redundancy procedures;
    8. Contingency plans;
    9. Virus protection;
    10. Patch management;
    11. Media Disposal and/or Re-use;
    12. Documentation requirements.

Supervision of Workforce Responsibilities

Although the Security Officer is responsible for implementing and overseeing all activities related to maintaining compliance, it is the responsibility of all workforce members (i.e. team leaders, supervisors, managers, directors, co-workers, etc.) to supervise all workforce members and any other user of Datica’s systems, applications, servers, workstations, etc. that contain ePHI.

  1. Monitor workstations and applications for unauthorized use, tampering, and theft and report non-compliance according to the Security Incident Response policy.

  2. Assist the Security and Privacy Officers to ensure appropriate role-based access is provided to all users.

  3. Take all reasonable steps to hire, retain, and promote workforce members and provide access to users who comply with the Security regulation and Datica’s security policies and procedures.

Sanctions of Workforce Responsibilities

All workforce members report non-compliance of Datica’s policies and procedures to the Security Officer or other individual as assigned by the Security Officer. Individuals that report violations in good faith may not be subjected to intimidation, threats, coercion, discrimination against, or any other retaliatory action as a consequence.

  1. The Security Officer promptly facilitates a thorough investigation of all reported violations of Datica’s security policies and procedures. The Security Officer may request the assistance from others.

    1. Complete an audit trail/log to identify and verify the violation and sequence of events.
    2. Interview any individual that may be aware of or involved in the incident.
    3. All individuals are required to cooperate with the investigation process and provide factual information to those conducting the investigation.
    4. Provide individuals suspected of non-compliance of the Security rule and/or Datica’s policies and procedures the opportunity to explain their actions.
    5. The investigators thoroughly documents the investigation as the investigation occurs.
  2. Violation of any security policy or procedure by workforce members may result in corrective disciplinary action, up to and including termination of employment. Violation of this policy and procedures by others, including business associates, customers, and partners may result in termination of the relationship and/or associated privileges. Violation may also result in civil and criminal penalties as determined by federal and state laws and regulations.

    1. A violation resulting in a breach of confidentiality (i.e. release of PHI to an unauthorized individual), change of the integrity of any ePHI, or inability to access any ePHI by other users, requires immediate termination of the workforce member from Datica.
  3. The Security Officer facilitates taking appropriate steps to prevent recurrence of the violation (when possible and feasible).

  4. In the case of an insider threat, the Security Officer and Privacy Officer are to setup a team to investigate and mitigate the risk of insider malicious activity. Datica workforce members are encouraged to come forward with information about insider threats, and can do so anonymously.

  5. The Security Officer maintains all documentation of the investigation, sanctions provided, and actions taken to prevent reoccurrence for a minimum of six years after the conclusion of the investigation.

Data Management Policy

Datica has procedures to create and maintain retrievable exact copies of electronic protected health information (ePHI) stored in conjunction with Datica Add-ons and for PaaS Customers utilizing our Backup Service. This policy, and associated procedures for testing and restoring from backup data, do not apply to PaaS Customers that do not choose Datica Backup Service. The policy and procedures will assure that complete, accurate, retrievable, and tested backups are available for all systems used by Datica.

Data backup is an important part of the day-to-day operations of Datica. To protect the confidentiality, integrity, and availability of ePHI, both for Datica and Datica Customers, completes backups are done daily to assure that data remains available when it needed and in case of disaster.

Violation of this policy and its procedures by workforce members may result in corrective disciplinary action, up to and including termination of employment.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Backup Policy and Procedures

  1. Perform daily snapshot backups of all systems that process, store, or transmit ePHI for Datica Customers, including PaaS Customers that utilize the Datica Backup Service
  2. Datica Ops Team, lead by VP of Engineering, is designated to be in charge of backups.
  3. Dev Ops Team members are trained and assigned assigned to complete backups and manage the backup media.
  4. Document backups
    • Name of the system
    • Date & time of backup
    • Where backup stored (or to whom it was provided)
  5. Securely encrypt stored backups in a manner that protects them from loss or environmental damage.
  6. Test backups and document that files have been completely and accurately restored from the backup media.

System Access Policy

Access to Datica systems and application is limited for all users, including but not limited to workforce members, volunteers, business associates, contracted providers, consultants, and any other entity, is allowable only on a minimum necessary basis. All users are responsible for reporting an incident of unauthorized user or access of the organization’s information systems. These safeguards have been established to address the HIPAA Security regulations including the following:

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Access Establishment and Modification

Workforce Clearance Procedures

Access Authorization

Person or Entity Authentication

Unique User Identification

Automatic Logoff

Employee Workstation Use

All workstations at Datica are company owned, and all are laptop Apple products running Mac operating system.

Wireless Access Use

Employee Termination Procedures

Paper Records

Datica does not use paper records for any sensitive information. Use of paper for recording and storing sensitive data is against Datica policies.

Password Management

PaaS Customer Access to Systems

Datica grants PaaS customer secure system access via VPN connections. This access is only to Customer-specific systems, no other systems in the environment. These connections are setup at customer deployment. These connections are secured and encrypted and the only method for customers to connect to Datica hosted systems.

In the case of data migration, Datica does, on a case by case basis, support customers in importing data. In these cases Datica support SCP assuring all data is secured and encrypted in transit.

In the case of an investigation, Datica will assist customers, at Datica’s discretion, and law enforcement in forensics.

Auditing Policy

Datica shall audit access and activity of electronic protected health information (ePHI) applications and systems in order to ensure compliance. The Security Rule requires healthcare organizations to implement reasonable hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. Audit activities may be limited by application, system, and/or network auditing capabilities and resources. Datica shall make reasonable and good-faith efforts to safeguard information privacy and security through a well-thought-out approach to auditing that is consistent with available resources.

It is the policy of Datica to safeguard the confidentiality, integrity, and availability of applications, systems, and networks. To ensure that appropriate safeguards are in place and effective, Datica shall audit access and activity to detect, report, and guard against:

This policy applies to all Datica Add-on systems, including BaaS, that store, transmit, or process ePHI. This policy, and associated procedures, do not apply to PaaS Customers that do not choose Datica Logging Service.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Auditing Policies

  1. Responsibility for auditing information system access and activity is assigned to Datica’s Security Officer. The Security Officer shall:
    • Assign the task of generating reports for audit activities to the workforce member responsible for the application, system, or network;
    • Assign the task of reviewing the audit reports to the workforce member responsible for the application, system, or network, the Privacy Officer, or any other individual determined to be appropriate for the task;
    • Organize and provide oversight to a team structure charged with audit compliance activities (e.g., parameters, frequency, sample sizes, report formats, evaluation, follow-up, etc.).
    • All connections to Datica are monitored. Access is limited to certain services, ports, and destinations. Exceptions to these rules, if created, are reviewed on an annual basis.
  2. Datica’s auditing processes shall address access and activity at the following levels listed below. In the case of PaaS Customers, Application and User level auditing is the responsibility of the Customer; Datica provides software to aggregate and view User and Application logs, but the log data collected is the responsibility of the PaaS Customer. Auditing processes may address date and time of each log-on attempt, date and time of each log-off attempt, devices used, functions performed, etc.
    • User: User level audit trails generally monitor and log all commands directly initiated by the user, all identification and authentication attempts, and data and services accessed.
    • Application: Application level audit trails generally monitor and log all user activities, including data accessed and modified and specific actions.
    • System: System level audit trails generally monitor and log user activities, applications accessed, and other system defined specific actions. Datica utilizes file system monitoring from OSSEC to assure the integrity of file system data.
    • Network: Network level audit trails generally monitor information on what is operating, penetrations, and vulnerabilities.
  3. Datica shall log all incoming and outgoing traffic to into and out of its environment. This includes all successful and failed attempts at data access and editing. Data associated with this data will include origin, destination, time, and other relevant details that are available to Datica.
  4. Datica utilizes OSSEC to scan all systems for malicious and unauthorized software every 2 hours and at reboot of systems. Alerts from OSSEC are sent to Kibana, the centralized logging service that we use.
  5. Datica leverages process monitoring tools throughout its environment.
  6. Datica treats its Developer Portal as a Platform Add-on and, as such, it logs all activity associated with Developer Portal Access.
  7. Datica uses OSSEC to monitor the integrity of log files by utilizing OSSEC System Integrity Checking capabilities.
  8. Datica shall identify “trigger events” or criteria that raise awareness of questionable conditions of viewing of confidential information. The “events” may be applied to the entire Datica Platform or may be specific to a Customer, partner, business associate, Platform Add-on or application (See Listing of Potential Trigger Events below).
  9. In addition to trigger events, Datica utilizes OSSEC log correlation functionality to proactively identify and enable alerts based on log data.
  10. Logs are reviewed weekly by Security Officer.
  11. Datica’s Security Officer and Privacy Officer are authorized to select and use auditing tools that are designed to detect network vulnerabilities and intrusions. Such tools are explicitly prohibited by others, including Customers and Partners, without the explicit authorization of the Security Officer. These tools may include, but are not limited to:
    • Scanning tools and devices;
    • Password cracking utilities;
    • Network “sniffers.”
    • Passive and active intrusion detection systems.
  12. The process for review of audit logs, trails, and reports shall include:
    • Description of the activity as well as rationale for performing the audit.
    • Identification of which Datica workforce members will be responsible for review (workforce members shall not review audit logs that pertain to their own system activity).
    • Frequency of the auditing process.
    • Determination of significant events requiring further review and follow-up.
    • Identification of appropriate reporting channels for audit results and required follow-up.
  13. Vulnerability testing software may be used to probe the network to identify what is running (e.g., operating system or product versions in place), whether publicly-known vulnerabilities have been corrected, and evaluate whether the system can withstand attacks aimed at circumventing security controls.
    • Testing may be carried out internally or provided through an external third-party vendor. Whenever possible, a third party auditing vendor should not be providing the organization IT oversight services (e.g., vendors providing IT services should not be auditing their own services - separation of duties).
    • Testing shall be done on a routine basis, currently monthly.
  14. Software patches and updates will be applied to all systems in a timely manner. In the case of routine updates, they will be applied after thorough testing. In the case of updates to correct known vulnerabilities, priority will be given to testing to speed the time to production. Critical security patches are applied within 30 days from testing and all security patches are applied within 90 days after testing.
    • In the case of PaaS Customers, updates to Application and Database versions are the responsibility of Customers, though Datica will, at it’s own discretion, notify and recommend updates to customer systems.

Audit Requests

  1. A request may be made for an audit for a specific cause. The request may come from a variety of sources including, but not limited to, Privacy Officer, Security Officer, Customer, Partner, or an Application owner or application user.
  2. A request for an audit for specific cause must include time frame, frequency, and nature of the request. The request must be reviewed and approved by Datica’s Privacy or Security Officer.
  3. A request for an audit must be approved by Datica’s Privacy Officer and/or Security Officer before proceeding. Under no circumstances shall detailed audit information be shared with parties without proper permissions and access to see such data.
    • Should the audit disclose that a workforce member has accessed ePHI inappropriately, the minimum necessary/least privileged information shall be shared with Datica’s Security Officer to determine appropriate sanction/ corrective disciplinary action.
    • Only de-identified information shall be shared with Customer or Partner regarding the results of the investigative audit process. This information will be communicated to the appropriate personnel by Datica’s Privacy Officer or designee. Prior to communicating with customers and partners regarding an audit, it is recommended that Datica consider seeking risk management and/or legal counsel.

Review and Reporting of Audit Findings

  1. Audit information that is routinely gathered must be reviewed in a timely manner, currently monthly, by the responsible workforce member(s).
    • On a quarterly basis, logs are reviewed to assure the proper data is being captured and retained.
  2. The reporting process shall allow for meaningful communication of the audit findings to those workforce members, Customers, or Partners requesting the audit.
    • Significant findings shall be reported immediately in a written format. Datica’s security incident response form may be utilized to report a single event.
    • Routine findings shall be reported to the sponsoring leadership structure in a written report format.
  3. Reports of audit results shall be limited to internal use on a minimum necessary/need-to-know basis. Audit results shall not be disclosed externally without administrative and/or legal counsel approval.
  4. Security audits constitute an internal, confidential monitoring practice that may be included in Datica’s performance improvement activities and reporting. Care shall be taken to ensure that the results of the audits are disclosed to administrative level oversight structures only and that information which may further expose organizational risk is shared with extreme caution. Generic security audit information may be included in organizational reports (individually-identifiable e PHI shall not be included in the reports).
  5. Whenever indicated through evaluation and reporting, appropriate corrective actions must be undertaken. These actions shall be documented and shared with the responsible workforce members, Customers, and/or Partners.

Auditing Customer and Partner Activity

  1. Periodic monitoring of Customer and Partner activity shall be carried out to ensure that access and activity is appropriate for privileges granted and necessary to the arrangement between Datica and the 3rd party. Datica will make every effort to assure Customers and Partners do not gain access to data outside of their own Environments.
  2. If it is determined that the Customer or Partner has exceeded the scope of access privileges, Datica’s leadership must remedy the problem immediately.
  3. If it is determined that a Customer or Partner has violated the terms of the HIPAA business associate agreement or any terms within the HIPAA regulations, Datica must take immediate action to remediate the situation. Continued violations may result in discontinuation of the business relationship.

Audit Log Security Controls and Backup

  1. Audit logs shall be protected from unauthorized access or modification, so the information they contain will be made available only if needed to evaluate a security incident or for routine audit activities as outlined in this policy.
  2. All audit logs are encrypted in transit and at rest to control access to the content of the logs.
  3. Audit logs shall be stored on a separate system to minimize the impact auditing may have on the privacy system and to prevent access to audit trails by those with system administrator privileges. This is done to apply the security principle of “separation of duties” to protect audit trails from hackers.
  4. For PaaS Customers choosing to use Datica logging services, log data will be separated from the log data of other Datica Customers.

Workforce Training, Education, Awareness and Responsibilities

  1. Datica workforce members are provided training, education, and awareness on safeguarding the privacy and security of business and ePHI. Datica’s commitment to auditing access and activity of the information applications, systems, and networks is communicated through new employee orientation, ongoing training opportunities and events, and applicable policies. Datica workforce members are made aware of responsibilities with regard to privacy and security of information as well as applicable sanctions/corrective disciplinary actions should the auditing process detect a workforce member’s failure to comply with organizational policies.
  2. Datica Customers are provided with necessary information to understand Datica auditing capabilities, and PaaS Customers can choose the level of logging and auditing that Datica will implement on their behalf.

External Audits of Information Access and Activity

  1. Prior to contracting with an external audit firm, Datica shall:
    • Outline the audit responsibility, authority, and accountability;
    • Choose an audit firm that is independent of other organizational operations;
    • Ensure technical competence of the audit firm staff;
    • Require the audit firm’s adherence to applicable codes of professional ethics;
    • Obtain a signed HIPAA business associate agreement;
    • Assign organizational responsibility for supervision of the external audit firm.

Retention of Audit Data

  1. Audit logs shall be maintained based on organizational needs. There is no standard or law addressing the retention of audit log/trail information. Retention of this information shall be based on: A. Organizational history and experience. B. Available storage space.
  2. Reports summarizing audit activities shall be retained for a period of six years.
  3. Log data is currently retained and readily accessible for a 1-month period. Beyond that, log data is available via cold backup.
  4. For Paas Customers, they choose the length of backup retention and availability that Datica will implement and enforce.

Potential Trigger Events

Configuration Management Policy

Datica standardizes and automates configuration management through the use of Chef/Salt scripts as well as documentation of all changes to production systems and networks. Chef and Salt automatically configure all Datica systems according to established and tested policies, and are used as part of our Disaster Recovery plan and process.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Configuration Management

  1. Chef and Salt are used to standardize and automate configuration management.
  2. OSSEC is used to scan systems every 2 hours and on reboot. These scans capture file system changes and also unauthorized or malicious software.
  3. No systems are deployed into Datica environments without approval of the Datica CTO.
  4. All changes to production systems, network devices, and firewalls are approved by the Datica CTO before they are implemented to assure they comply with business and security requirements. Additionally, all changes are tested before they are implemented in production. All changes are documented using issues filed in the “Deployment Ticket” JIRA project. Implementation of approved changes are only performed by authorized personnel.
  5. An up-to-date inventory of systems is maintained using Google spreadsheets and architecture diagrams hosted on Google Apps and Box. All systems are categorized as production and utility to differentiate based on criticality.
  6. Clocks are synchronized across all systems using NTP. Modifying time data on systems is restricted.
  7. All front end functionality (developer dashboards and portals) is separated from backend (database and app servers) systems by being deployed on separate servers.
  8. All software and systems are tested using unit tests and end to end tests.
  9. All committed code is reviewed using pull requests (on Github) to assure software code quality and proactively detect potential security issues in development.
  10. Datica utilizes development and staging environments that mirror production to assure proper function.
  11. Datica also deploys environments locally using Vagrant to assure functionality before moving to staging or production.
  12. Datica schedules production deployments every four weeks.
  13. All formal change requests require unique ID and authentication.
  14. Virus scanning software is run on all production hosts for anti-virus protection. Hosts are scanned daily for malicious binaries in critical system paths. The malware signature database is checked hourly and automatically updated if new signatures are available. Enabling anti-virus protection is a part of our Chef- and Salt-based configuration management baseline; this assures all hosts have anti-virus tools running on them.
  15. All physical media is encrypted at provisioning. To verify encryption is consistent and in place for all production storage, checks are performed on a quarterly basis.

Facility Access Policy

Datica works with Subcontractors to assure restriction of physical access to systems used as part of the Datica Platform. Datica and its Subcontractors control access to the physical buildings/facilities that house these systems/applications, or in which Datica workforce members operate, in accordance to the HIPAA Security Rule 164.310 and its implementation specifications. Physical Access to all of Datica facilities is limited to only those authorized in this policy. In an effort to safeguard ePHi from unauthorized access, tampering, and theft, access is allowed to areas only to those persons authorized to be in them and with escorts for unauthorized persons. All workforce members are responsible for reporting an incident of unauthorized visitor and/or unauthorized access to Datica’s facility.

Of note, Datica does not have ready access to ePHI, it provides cloud-based, compliant infrastructure to covered entities and business associates. Datica does not physically house any systems used by its Platform in Datica facilities. Physical security of our Platform servers is outlined here.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Datica-controlled Facility Access Policies

  1. Visitor and third party support access is recorded and supervised. All visitors are escorted.
  2. Repairs are documented and the documentation is retained.
  3. Fire extinguishers and detectors are installed according to applicable laws and regulations.
  4. Maintenance is controlled and conducted by authorized personnel in accordance with supplier-recommended intervals, insurance policies and the organizations maintenance program.
  5. Electronic and physical media containing covered information is securely destroyed (or the information securely removed) prior to disposal.
  6. The organization securely disposes media with sensitive information.
  7. Physical access is restricted using smart locks that track all access.
    • Restricted areas and facilities are locked and when unattended (where feasible).
    • Only authorized workforce members receive access to restricted areas (as determined by the Security Officer).
    • Access and keys are revoked upon termination of workforce members.
    • Workforce members must report a lost and/or stolen key(s) to the Security Officer.
    • The Security Officer facilitates the changing of the lock(s) within 7 days of a key being reported lost/stolen
  8. Enforcement of Facility Access Policies
    • Report violations of this policy to the restricted area’s department team leader, supervisor, manager, or director, or the Privacy Officer.
    • Workforce members in violation of this policy are subject to disciplinary action, up to and including termination.
    • Visitors in violation of this policy are subject to loss of vendor privileges and/or termination of services from Datica.
  9. Workstation Security
    • Workstations may only be accessed and utilized by authorized workforce members to complete assigned job/contract responsibilities.
    • All workforce members are required to monitor workstations and report unauthorized users and/or unauthorized attempts to access systems/applications as per the System Access Policy.
    • All workstations purchased by Datica are the property of Datica and are distributed to users by the company.

Incident Response Policy

Datica implements an information security incident response process to consistently detect, respond, and report incidents, minimize loss and destruction, mitigate the weaknesses that were exploited, and restore information system functionality and business continuity as soon as possible.

The incident response process addresses:

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Incident Management Policies

The Datica incident response process follows the process recommended by SANS, an industry leader in security (www.sans.org). Process flows are a direct representation of the SANS process. Review Appendix 1 for a flowchart identifying each phase.

Identification Phase

  1. Immediately upon observation Datica members report suspected and known Precursors, Events, Indications, and Incidents in one of the following ways:
    1. Direct report to management, the Security Officer, Privacy Officer, or other;
    2. Email;
    3. Phone call;
    4. Online incident response form located here;
    5. Secure Chat.
    6. Anonymously through workforce members desired channels.
    7. The individual receiving the report facilitates completion of an Incident Identification form and notifies the Security Officer (if not already done).
    8. The Security Officer determines if the issue is a Precursor, Event, Indication, or Incident.
    9. If the issue is an event, indication, or precursor the Security Officer forwards it to the appropriate resource for resolution.
      1. Non-Technical Event (minor infringement): the Security Officer completes a SIR Form (see Appendix 2) and investigates the incident.
      2. Technical Event: Assign the issue to an IT resource for resolution. This resource may also be a contractor or outsourced technical resource, in the event of a small office or lack of expertise in the area.
    10. If the issue is a security incident the Security Officer activates the Security Incident Response Team (SIRT) and notifies senior management.
      1. If a non-technical security incident is discovered the SIRT completes the investigation, implements preventative measures, and resolves the security incident.
      2. Once the investigation is completed, progress to Phase V, Follow-up.
      3. If the issue is a technical security incident, commence to Phase II: Containment.
      4. The Containment, Eradication, and Recovery Phases are highly technical. It is important to have them completed by a highly qualified technical security resource with oversight by the SIRT team.
      5. Each individual on the SIRT and the technical security resource document all measures taken during each phase, including the start and end times of all efforts.
      6. The lead member of the SIRT team facilitates initiation of a Security Incident Report (SIR) Form (See Appendix 2 for sample format) or an Incident Survey Form (See Appendix 4). The intent of the SIR form is to provide a summary of all events, efforts, and conclusions of each Phase of this policy and procedures.
    11. The Security Officer, Privacy Officer, or Datica representative appointed notifies any affected Customers and Partners. If no Customers and Partners are affected, notification is at the discretion of the Security and Privacy Officer.
    12. In the case of a threat identified, the Security Officer is to form a team to investigate and involve necessary resources, both internal to Datica and potentially external.

Containment Phase (Technical)

In this Phase, Datica’s IT department attempts to contain the security incident. It is extremely important to take detailed notes during the security incident response process. This provides that the evidence gathered during the security incident can be used successfully during prosecution, if appropriate.

  1. The SIRT reviews any information that has been collected by the Security Officer or any other individual investigating the security incident.
  2. The SIRT secures the network perimeter.
  3. The IT department performs the following:
    1. Securely connect to the affected system over a trusted connection.
    2. Retrieve any volatile data from the affected system.
    3. Determine the relative integrity and the appropriateness of backing the system up.
    4. If appropriate, back up the system.
    5. Change the password(s) to the affected system(s).
    6. Determine whether it is safe to continue operations with the affect system(s).
    7. If it is safe, allow the system to continue to function;
      1. Complete any documentation relative to the security incident on the SIR Form.
      2. Move to Phase V, Follow-up.
    8. If it is NOT safe to allow the system to continue operations, discontinue the system(s) operation and move to Phase III, Eradication.
    9. The individual completing this phase provides written communication to the SIRT.
  4. Continuously apprise Senior Management of progress.
  5. Continue to notify affected Customers and Partners with relevant updates as needed

Eradication Phase (Technical)

The Eradication Phase represents the SIRT’s effort to remove the cause, and the resulting security exposures, that are now on the affected system(s).

  1. Determine symptoms and cause related to the affected system(s).
  2. Strengthen the defenses surrounding the affected system(s), where possible (a risk assessment may be needed and can be determined by the Security Officer). This may include the following:
    1. An increase in network perimeter defenses.
    2. An increase in system monitoring defenses.
    3. Remediation (“fixing”) any security issues within the affected system, such as removing unused services/general host hardening techniques.
  3. Conduct a detailed vulnerability assessment to verify all the holes/gaps that can be exploited have been addressed.
    1. If additional issues or symptoms are identified, take appropriate preventative measures to eliminate or minimize potential future compromises.
  4. Complete the Eradication Form (see Appendix 4).
  5. Update the documentation with the information learned from the vulnerability assessment, including the cause, symptoms, and the method used to fix the problem with the affected system(s).
  6. Apprise Senior Management of the progress.
  7. Continue to notify affected Customers and Partners with relevant updates as needed.
  8. Move to Phase IV, Recovery.

Recovery Phase (Technical)

The Recovery Phase represents the SIRT’s effort to restore the affected system(s) back to operation after the resulting security exposures, if any, have been corrected.

  1. The technical team determines if the affected system(s) have been changed in any way.
    1. If they have, the technical team restores the system to its proper, intended functioning (“last known good”).
    2. Once restored, the team validates that the system functions the way it was intended/had functioned in the past. This may require the involvement of the business unit that owns the affected system(s).
    3. If operation of the system(s) had been interrupted (i.e., the system(s) had been taken offline or dropped from the network while triaged), restart the restored and validated system(s) and monitor for behavior.
    4. If the system had not been changed in any way, but was taken offline (i.e., operations had been interrupted), restart the system and monitor for proper behavior.
    5. Update the documentation with the detail that was determined during this phase.
    6. Apprise Senior Management of progress.
    7. Continue to notify affected Customers and Partners with relevant updates as needed.
    8. Move to Phase V, Follow-up.

Follow-up Phase (Technical and Non-Technical)

The Follow-up Phase represents the review of the security incident to look for “lessons learned” and to determine whether the process that was taken could have been improved in any way. It is recommended all security incidents be reviewed shortly after resolution to determine where response could be improved. Timeframes may extend to one to two weeks post-incident.

  1. Responders to the security incident (SIRT Team and technical security resource) meet to review the documentation collected during the security incident.
  2. Create a “lessons learned” document and attach it to the completed SIR Form.
    1. Evaluate the cost and impact of the security incident to Datica using the documents provided by the SIRT and the technical security resource.
    2. Determine what could be improved.
    3. Communicate these findings to Senior Management for approval and for implementation of any recommendations made post-review of the security incident.
    4. Carry out recommendations approved by Senior Management; sufficient budget, time and resources should be committed to this activity.
    5. Close the security incident.

Periodic Evaluation

It is important to note that the processes surrounding security incident response should be periodically reviewed and evaluated for effectiveness. This also involves appropriate training of resources expected to respond to security incidents, as well as the training of the general population regarding the Datica’s expectation for them, relative to security responsibilities. The incident response plan is tested annually.

Security Incident Response Team (SIRT)

Individuals needed and responsible to respond to a security incident make up a Security Incident Response Team (SIRT). Members may include the following:

Breach Policy

To provide guidance for breach notification when impressive or unauthorized access, acquisition, use and/or disclosure of the ePHI occurs. Breach notification will be carried out in compliance with the American Recovery and Reinvestment Act (ARRA)/Health Information Technology for Economic and Clinical Health Act (HITECH) as well as any other federal or state notification law.

The Federal Trade Commission (FTC) has published breach notification rules for vendors of personal health records as required by ARRA/HITECH. The FTC rule applies to entities not covered by HIPAA, primarily vendors of personal health records. The rule is effective September 24, 2009 with full compliance required by February 22, 2010.

The American Recovery and Reinvestment Act of 2009 (ARRA) was signed into law on February 17, 2009. Title XIII of ARRA is the Health Information Technology for Economic and Clinical Health Act (HITECH). HITECH significantly impacts the Health Insurance Portability and Accountability (HIPAA) Privacy and Security Rules. While HIPAA did not require notification when patient protected health information (PHI) was inappropriately disclosed, covered entities and business associates may have chosen to include notification as part of the mitigation process. HITECH does require notification of certain breaches of unsecured PHI to the following: individuals, Department of Health and Human Services (HHS), and the media. The effective implementation for this provision is September 23, 2009 (pending publication HHS regulations).

In the case of a breach, Datica shall notify all affected Customers. It is the responsibility of the Customers to notify affected individuals.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Datica Breach Policy

  1. Discovery of Breach: A breach of ePHI shall be treated as “discovered” as of the first day on which such breach is known to the organization, or, by exercising reasonable diligence would have been known to Datica (includes breaches by the organization’s Customers, Partners, or subcontractors). Datica shall be deemed to have knowledge of a breach if such breach is known or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or Partner of the organization. Following the discovery of a potential breach, the organization shall begin an investigation (see organizational policies for security incident response and/or risk management incident response) immediately, conduct a risk assessment, and based on the results of the risk assessment, begin the process to notify each Customer affected by the breach. Datica shall also begin the process of determining what external notifications are required or should be made (e.g., Secretary of Department of Health & Human Services (HHS), media outlets, law enforcement officials, etc.)
  2. Breach Investigation: The Datica Security Officer shall name an individual to act as the investigator of the breach (e.g., privacy officer, security officer, risk manager, etc.). The investigator shall be responsible for the management of the breach investigation, completion of a risk assessment, and coordinating with others in the organization as appropriate (e.g., administration, security incident response team, human resources, risk management, public relations, legal counsel, etc.) The investigator shall be the key facilitator for all breach notification processes to the appropriate entities (e.g., HHS, media, law enforcement officials, etc.). All documentation related to the breach investigation, including the risk assessment, shall be retained for a minimum of six years. A template breach log is located here.
  3. Risk Assessment: For an acquisition, access, use or disclosure of ePHI to constitute a breach, it must constitute a violation of the HIPAA Privacy Rule. A use or disclosure of ePHI that is incident to an otherwise permissible use or disclosure and occurs despite reasonable safeguards and proper minimum necessary procedures would not be a violation of the Privacy Rule and would not qualify as a potential breach. To determine if an impermissible use or disclosure of ePHI constitutes a breach and requires further notification, the organization will need to perform a risk assessment to determine if there is significant risk of harm to the individual as a result of the impermissible use or disclosure. The organization shall document the risk assessment as part of the investigation in the incident report form noting the outcome of the risk assessment process. The organization has the burden of proof for demonstrating that all notifications to appropriate Customers or that the use or disclosure did not constitute a breach. Based on the outcome of the risk assessment, the organization will determine the need to move forward with breach notification. The risk assessment and the supporting documentation shall be fact specific and address:
    • Consideration of who impermissibly used or to whom the information was impermissibly disclosed;
    • The type and amount of ePHI involved;
    • The cause of the breach, and the entity responsible for the breach, either Customer, Datica, or Partner.
    • The potential for significant risk of financial, reputational, or other harm.
  4. Timeliness of Notification: Upon discovery of a breach, notice shall be made to the affected Datica Customers no later than 4 hours after the discovery of the breach. It is the responsibility of the organization to demonstrate that all notifications were made as required, including evidence demonstrating the necessity of delay.
  5. Delay of Notification Authorized for Law Enforcement Purposes: If a law enforcement official states to the organization that a notification, notice, or posting would impede a criminal investigation or cause damage to national security, the organization shall:
    • If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting of the timer period specified by the official; or
    • If the statement is made orally, document the statement, including the identify of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described above is submitted during that time.
  6. Content of the Notice: The notice shall be written in plain language and must contain the following information:
    • A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
    • A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code or other types of information were involved), if known;
    • Any steps the Customer should take to protect Customer data from potential harm resulting from the breach.
    • A brief description of what Datica is doing to investigate the breach, to mitigate harm to individuals and Customers, and to protect against further breaches.
    • Contact procedures for individuals to ask questions or learn additional information, which may include a toll-free telephone number, an e-mail address, a web site, or postal address.
  7. Methods of Notification: Datica Customers will be notified via email and phone within the timeframe for reporting breaches, as outlined above.
  8. Maintenance of Breach Information/Log: As described above and in addition to the reports created for each incident, Datica shall maintain a process to record or log all breaches of unsecured ePHI regardless of the number of records and Customers affected. The following information should be collected/logged for each breach (see sample Breach Notification Log):
    • A description of what happened, including the date of the breach, the date of the discovery of the breach, and the number of records and Customers affected, if known.
    • A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, etc.), if known.
    • A description of the action taken with regard to notification of patients regarding the breach.
    • Resolution steps taken to mitigate the breach and prevent future occurrences.
  9. Workforce Training: Datica shall train all members of its workforce on the policies and procedures with respect to ePHI as necessary and appropriate for the members to carry out their job responsibilities. Workforce members shall also be trained as to how to identify and report breaches within the organization.
  10. Complaints: Datica must provide a process for individuals to make complaints concerning the organization’s patient privacy policies and procedures or its compliance with such policies and procedures.
  11. Sanctions: The organization shall have in place and apply appropriate sanctions against members of its workforce, Customers, and Partners who fail to comply with privacy policies and procedures.
  12. Retaliation/Waiver: Datica may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise by the individual of any privacy right. The organization may not require individuals to waive their privacy rights under as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.

Datica Platform Customer Responsibilities

  1. The Datica Customer that accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured ePHI shall, without unreasonable delay and in no case later than 60 calendar days after discovery of a breach, notify Datica of such breach. The Customer shall provide Datica with the following information:
    • A description of what happened, including the date of the breach, the date of the discovery of the breach, and the number of records and Customers affected, if known.
    • A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, etc.), if known.
    • A description of the action taken with regard to notification of patients regarding the breach.
    • Resolution steps taken to mitigate the breach and prevent future occurrences.
  2. Notice to Media: Datica Customers are responsible for providing notice to prominent media outlets at the Customer’s discretion.
  3. Notice to Secretary of HHS: Datica Customers are responsible for providing notice to the Secretary of HHS at the Customer’s discretion.

Sample Letter to Customers in Case of Breach

[Date]

[Name here] [Address 1 Here] [Address 2 Here] [City, State Zip Code]

Dear [Name of Customer]:

I am writing to you from Datica Health, Inc., with important information about a recent breach that affects your account with us. We became aware of this breach on [Insert Date] which occurred on or about [Insert Date]. The breach occurred as follows:

Describe event and include the following information: A. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known. B. A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code or other types of information were involved), if known. C. Any steps the Customer should take to protect themselves from potential harm resulting from the breach. D. A brief description of what Datica is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches. E. Contact procedures for individuals to ask questions or learn additional information, which includes a toll-free telephone number, an e-mail address, web site, or postal address.

Other Optional Considerations:

We will assist you in remedying the situation.

Sincerely,

Travis Good, MD Co-founder - Datica Health, Inc. travis@datica.com 303-351-2640

Disaster Recovery Policy

The Datica Contingency Plan establishes procedures to recover Datica following a disruption resulting from a disaster. This Disaster Recovery Policy is maintained by the Datica Security Officer and Privacy Officer.

The following objectives have been established for this plan:

  1. Maximize the effectiveness of contingency operations through an established plan that consists of the following phases:
    • Notification/Activation phase to detect and assess damage and to activate the plan;
    • Recovery phase to restore temporary IT operations and recover damage done to the original system;
    • Reconstitution phase to restore IT system processing capabilities to normal operations.
  2. Identify the activities, resources, and procedures needed to carry out Datica processing requirements during prolonged interruptions to normal operations.
  3. Identify and define the impact of interruptions to Datica systems.
  4. Assign responsibilities to designated personnel and provide guidance for recovering Datica during prolonged periods of interruption to normal operations.
  5. Ensure coordination with other Datica staff who will participate in the contingency planning strategies.
  6. Ensure coordination with external points of contact and vendors who will participate in the contingency planning strategies.

This Datica Contingency Plan has been developed as required under the Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources, Appendix III, November 2000, and the Health Insurance Portability and Accountability Act (HIPAA) Final Security Rule, Section §164.308(a)(7), which requires the establishment and implementation of procedures for responding to events that damage systems containing electronic protected health information.

This Datica Contingency Plan is created under the legislative requirements set forth in the Federal Information Security Management Act (FISMA) of 2002 and the guidelines established by the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, titled “Contingency Planning Guide for Information Technology Systems” dated June 2002.

The Datica Contingency Plan also complies with the following federal and departmental policies:

Example of the types of disasters that would initiate this plan are natural disaster, political disturbances, man made disaster, external human threats, internal malicious activities.

Datica defined two categories of systems from a disaster recovery perspective.

  1. Critical Systems. These systems host application servers and database servers or are required for functioning of systems that host application servers and database servers. These systems, if unavailable, affect the integrity of data and must be restored, or have a process begun to restore them, immediately upon becoming unavailable.
  2. Non-critical Systems. These are all systems not considered critical by definition above. These systems, while they may affect the performance and overall security of critical systems, do not prevent Critical systems from functioning and being accessed appropriately. These systems are restored at a lower priority than critical systems.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Line of Succession

The following order of succession to ensure that decision-making authority for the Datica Contingency Plan is uninterrupted. The Chief Technology Officer (CTO) and Security Officer, Adam Leko, are responsible for ensuring the safety of personnel and the execution of procedures documented within this Datica Contingency Plan. If the CTO and VP of Engineering are unable to function as the overall authority or chooses to delegate this responsibility to a successor, the CEO or CPO shall function as that authority. To provide contact initiation should the contingency plan need to be initiated, please use the contact list below.

Responsibilities

The following teams have been developed and trained to respond to a contingency event affecting the IT system.

  1. The Ops Team is responsible for recovery of the Datica hosted environment, network devices, and all servers. Members of the team include personnel who are also responsible for the daily operations and maintenance of Datica. The team leader is the VP of Engineering and directs the Dev Ops Team.
  2. The Web Services Team is responsible for assuring all application servers, web services, and platform add-ons are working. It is also responsible for testing redeployments and assessing damage to the environment. The team leader is the CTO and directs the Web Services Team.

Testing and Maintenance

The CTO and VP of Engineering shall establish criteria for validation/testing of a Contingency Plan, an annual test schedule, and ensure implementation of the test. This process will also serve as training for personnel involved in the plan’s execution. At a minimum the Contingency Plan shall be tested annually (within 365 days). The types of validation/testing exercises include tabletop and technical testing. Contingency Plans for all application systems must be tested at a minimum using the tabletop testing process. However, if the application system Contingency Plan is included in the technical testing of their respective support systems that technical test will satisfy the annual requirement.

Tabletop Testing

Tabletop Testing is conducted in accordance with the the CMS Risk Management Handbook, Volume 2 (http://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-Information-Technology/InformationSecurity/Downloads/RMH_VII_4-5_Contingency_Plan_Exercise.pdf). The primary objective of the tabletop test is to ensure designated personnel are knowledgeable and capable of performing the notification/activation requirements and procedures as outlined in the CP, in a timely manner. The exercises include, but are not limited to:

Technical Testing

The primary objective of the technical test is to ensure the communication processes and data storage and recovery processes can function at an alternate site to perform the functions and capabilities of the system within the designated requirements. Technical testing shall include, but is not limited to:

1. Notification and Activation Phase

This phase addresses the initial actions taken to detect and assess damage inflicted by a disruption to Datica. Based on the assessment of the Event, sometimes according to the Datica Incident Response Policy, the Contingency Plan may be activated by either the CTO or VP of Engineering.

The notification sequence is listed below:

2. Recovery Phase

This section provides procedures for recovering the application at an alternate site, whereas other efforts are directed to repair damage to the original system and capabilities.

The following procedures are for recovering the Datica infrastructure at the alternate site. Procedures are outlined per team required. Each procedure should be executed in the sequence it is presented to maintain efficient operations.

Recovery Goal: The goal is to rebuild Datica infrastructure to a production state.

The tasks outlines below are not sequential and some can be run in parallel.

  1. Contact Partners and Customers affected - Web Services
  2. Assess damage to the environment - Web Services
  3. Begin replication of new environment using automated and tested scripts, currently Chef and Salt. At this point it is determined whether to recover in Rackspace, AWS, Azure, or SoftLayer. - Dev Ops
  4. Test new environment using pre-written tests - Web Services
  5. Test logging, security, and alerting functionality - Dev Ops
  6. Assure systems are appropriately patched and up to date. - Dev Ops
  7. Deploy environment to production - Web Services
  8. Update DNS to new environment. - Dev Ops

3. Reconstitution Phase

This section discusses activities necessary for restoring Datica operations at the original or new site. The goal is to restore full operations within 24 hours of a disaster or outage. When the hosted data center at the original or new site has been restored, Datica operations at the alternate site may be transitioned back. The goal is to provide a seamless transition of operations from the alternate site to the computer center.

  1. Original or New Site Restoration

    • Begin replication of new environment using automated and tested scripts, currently Chef and Salt. - Dev Ops
    • Test new environment using pre-written tests. - Web Services
    • Test logging, security, and alerting functionality. - Dev Ops
    • Deploy environment to production - Web Services
    • Assure systems are appropriately patched and up to date. - Dev Ops
    • Update DNS to new environment. - Dev Ops
  2. Plan Deactivation

If the Datica environment is moved back to the original site from the alternative site, all hardware used at the alternate site should be handled and disposed of according to the Datica Media Disposal Policy.

Disposable Media Policy

Datica recognizes that media containing ePHI may be reused when appropriate steps are taken to ensure that all stored ePHI has been effectively rendered inaccessible. Destruction/disposal of ePHI shall be carried out in accordance with federal and state law. The schedule for destruction/disposal shall be suspended for ePHI involved in any open investigation, audit, or litigation.

Datica utilizes dedicated hardware from Subcontractors. ePHI is only stored on SSD volumes in our hosted environment. All SSD volumes utilized by Datica and Datica Customers are encrypted. Datica does not use, own, or manage any mobile devices, SD cards, or tapes that have access to ePHI.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Disposable Media Policy

  1. All removable media is restricted, audited, and is encrypted.
  2. Datica assumes all disposable media in its Platform may contain ePHI, so it treats all disposable media with the same protections and disposal policies.
  3. All destruction/disposal of ePHI media will be done in accordance with federal and state laws and regulations and pursuant to the Datica’s written retention policy/schedule. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner.
  4. Records involved in any open investigation, audit or litigation should not be destroyed/disposed of. If notification is received that any of the above situations have occurred or there is the potential for such, the record retention schedule shall be suspended for these records until such time as the situation has been resolved. If the records have been requested in the course of a judicial or administrative hearing, a qualified protective order will be obtained to ensure that the records are returned to the organization or properly destroyed/disposed of by the requesting party.
  5. Before reuse of any media, for example all ePHI is rendered inaccessible, cleaned, or scrubbed. All media is formatted to restrict future access.
  6. All Datica Subcontractors provide that, upon termination of the contract, they will return or destroy/dispose of all patient health information. In cases where the return or destruction/disposal is not feasible, the contract limits the use and disclosure of the information to the purposes that prevent its return or destruction/disposal.
  7. Any media containing ePHI is disposed using a method that ensures the ePHI could not be readily recovered or reconstructed.
  8. The methods of destruction, disposal, and reuse are reassessed periodically, based on current technology, accepted practices, and availability of timely and cost-effective destruction, disposal, and reuse technologies and services.
  9. In the cases of a Datica Customer terminating a contract with Datica and no longer utilize Datica Services, the following actions will be taken depending on the Datica Services in use. In all cases it is solely the responsibility of the Datica Customer to maintain the safeguards required of HIPAA once the data is transmitted out of Datica Systems.
    • In the case of BaaS Customer termination, Datica will provide the customer with the ability to export data in commonly used format, currently CSV, for 30 days from the time of termination.
    • In the case of PaaS Customer termination, Datica will provide the customer with 30 days from the date of termination to export data.

IDS Policy

In order to preserve the integrity of data that Datica stores, processes, or transmits for Customers, Datica implements strong intrusion detection tools and policies to proactively track and retroactively investigate unauthorized access. Datica currently utilizes OSSEC to track file system integrity, monitor log data, and detect rootkit access.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Intrusion Detection Policy

Vulnerability Scanning Policy

Datica is proactive about information security and understands that vulnerabilities need to be monitored on an ongoing basis. Datica utilizes Nessus Scanner from Tenable to consistently scan, identify, and address vulnerabilities on our systems. We also utilize OSSEC on all systems, including logs, for file integrity checking and intrusion detection.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Vulnerability Scanning Policy

Data Integrity Policy

Datica takes data integrity very seriously. As stewards and partners of Datica Customers, we strive to assure data is protected from unauthorized access and that it is available when needed. The following policies drive many of our procedures and technical settings in support of the Datica mission of data protection.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Data integrity Policy

Production Systems that create, receive, store, or transmit customer data (hereafter “Production Systems”) must follow the following guidelines.

Disabling non-essential services

Monitoring Log-in Attempts

Prevention of malware on Production Systems

Patch Management

Intrusion Detection and Vulnerability Scanning

Production System Security

Production Data Security

Transmission Security

Data Retention Policy

Despite not being a requirement within HIPAA, Datica understand and appreciates the importance of health data retention. Acting as a subcontractor, and at times a business associate, Datica is not directly responsible for health and medical records retention as set forth by each state. Despite this, Datica has created and implemented the following policy to make it easier for Datica Customers to support data retention laws.

State Medical Record Laws

Data Retention Policy

Employees Policy

Datica is committed to ensuring all workforce members actively address security and compliance in their roles at Datica. As such, training is imperative to assuring an understanding of current best practices, the different types and sensitivities of data, and the sanctions associated with non-compliance.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Employment Policies

  1. All new workforce members, including contractors, are given training on security policies and procedures, including operations security, within 30 days of employment.
    • Records of training are kept for all workforce members.
    • Upon completion of training, workforce members complete this form.
    • Ongoing security training is conducted monthly.
    • Current Datica training is hosted here.
  2. All workforce members are granted access to formal organizational policies, which include the sanction policy for security violations.
  3. The Datica Employee Handbook clearly states the responsibilities and acceptable behavior regarding information system usage, including rules for email, Internet, mobile devices and social media usage.
  4. Datica does not allow mobile devices to connect to any of its production networks.
  5. All workforce members are educated about the approved set of tools to be installed on workstations.
  6. All new workforce members are given HIPAA training within 60 days of beginning employment. Training includes HIPAA reporting requirements, including the ability to anonymously report security incidents, and the levels of compliance and obligations for Datica and its Customers and Partners.
  7. All remote (teleworking) workforce members are trained on the risks, the controls implemented, their responsibilities, and sanctions associated with violation of policies. Additionally, remote security is maintained through the use of VPN tunnels for all access to production systems with access to ePHI data.
  8. All Datica-purchased and -owned computers are to display this message at login and when the computer is unlocked: This computer is owned by Datica, Inc. By logging in, unlocking, and/or using this computer you acknowledge you have seen, and follow, these policies (https://policy.datica.com) and have completed this training (https://training.datica.com). Please contact us if you have problems with this - privacy@datica.com.
  9. Employees may only use Datica-purchased and -owned workstations for accessing production systems with access to ePHI data.
    • Any workstations used to access production systems must be configured as prescribed by the Employee Workstation Use section of the Systems Access Policy.
    • Any workstations used to access production systems must have virus protection software installed, configured, and enabled.
  10. Access to internal Datica systems can be requested using this form. All requests for access much be granted to the Datica Security Officer.
  11. Request for modifications of access for any Datica employee can be made using this form.

Approved Tools Policy

Datica utilizes a suite of approved software tools for internal use by workforce members. These software tools are either self-hosted, with security managed by Datica, or they are hosted by a Subcontractor with appropriate business associate agreements in place to preserve data integrity. Use of other tools requires approval from Datica leadership.

List of Approved Tools

3rd Party Policy

Datica makes every effort to assure all 3rd party organizations are compliant and do not compromise the integrity, security, and privacy of Datica or Datica Customer data. 3rd Parties include Customers, Partners, Subcontractors, and Contracted Developers.

Applicable Standards from the HITRUST Common Security Framework

Applicable Standards from the HIPAA Security Rule

Policies to Assure 3rd Parties Support Datica Compliance

  1. The following steps are required before 3rd parties are granted access to any Datica systems:
    • Due diligence with the 3rd party;
    • Controls implemented to maintain compliance;
    • Written agreements, with appropriate security requirements, are executed.
  2. All connections and data in transit between the Datica Platform and 3rd parties are encrypted end to end.
  3. Access granted to external parties is limited to the minimum necessary and granted only for the duration required.
  4. A standard business associate agreement with Customers and Partners is defined and includes the required security controls in accordance with the organization’s security policies. Additionally, responsibility is assigned in these agreements.
  5. Datica has Service Level Agreements (SLAs) with Subcontractors with an agreed service arrangement addressing liability, service definitions, security controls, and aspects of services management.
    • Datica utilizes monitoring tools to regularly evaluate Subcontractors against relevant SLAs.
  6. Third parties are unable to make changes to any Datica infrastructure without explicit permission from Datica. Additionally, no Datica Customers or Partners have access outside of their own environment, meaning they cannot access, modify, or delete anything related to other 3rd parties.
  7. Whenever outsourced development is utilized by Datica, all changes to production systems will be approved and implemented by Datica workforce members only. All outsourced development requires a formal contract with Datica.
  8. Datica maintains and annually reviews a list all current Partners and Subcontractors.
  9. Datica assesses security requirements and compliance considerations with all Partners and Subcontracts. This includes annual assessment of SOC2 Reports for all Catalytze infrastructure partners.
    • Datica leverages recurring calendar invites to assure reviews of SLAs with all 3rd parties are performed annually. These are performed by the Datica Security Officer and Privacy Officer. Google Forms are used to track such reviews.
  10. Regular review is conducted as required by SLAs to assure security and compliance. These reviews include reports, audit trails, security events, operational issues, failures and disruptions, and identified issues are investigated and resolved in a reasonable and timely manner.
  11. Any changes to Partner and Subcontractor services and systems are reviewed before implementation.
  12. For all partners, Datica reviews activity annually to assure partners are in line with SLAs in contracts with Datica.

Key Definitions

1. Any unintentional acquisition, access or use of PHI by a workforce member or person acting under the authority of a Covered Entity (CE) or Business Associate (BA) if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under the Privacy Rule.
2. Any inadvertent disclosure by a person who is authorized to access PHI at a CE or BA to another person authorized to access PHI at the same CE or BA, or organized health care arrangement in which the CE participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under the Privacy Rule.
3. A disclosure of PHI where a CE or BA has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

Datica HIPAA Business Associate Agreement (“BAA”)

This HIPAA Business Associate Agreement (this “BAA”) defines the rights and responsibilities of Provider and Customer with respect to Protected Health Information (“PHI”) as defined in the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder, including the HITECH Act and Omnibus Rule, as each may be amended from time to time (collectively, “HIPAA”). This BAA shall be applicable only in the event and to the extent Provider meets, with respect to Customer, the definition of a Business Associate set forth at 45 C.F.R. §160.103, or applicable successor provisions. This BAA shall only be applicable to Customer’s Hosting Services or Services to the extent that Customer uses the Hosting Services for Customer’s Applications and as specified in the Platform as a Service Agreement of which this Exhibit C is attached and fully referenced and incorporated herein (the “PaaS Agreement”). This BAA is intended to ensure that Business Associate and Customer will establish and implement appropriate safeguards where Business Associate may receive, create, maintain, use or disclose in connection with the functions, activities and services that Business Associate performs on behalf of Customer solely to perform its duties and responsibilities under the PaaS Agreement.

  1. Applicability and Definitions. This BAA applies only where:
    1. Customer uses the Hosting Services to store or transmit any PHI as defined in 45 C.F.R. §160.103
    2. Customer has applied the required security configurations, as specified in Section 5.2 of this BAA to Customer’s Applications. Customer acknowledges that this BAA does not apply to any other accounts it may have now or in the future. Unless otherwise expressly defined in this BAA, all capitalized terms in this BAA will have the meanings set forth in the PaaS Agreement or in HIPAA.
  2. Additional Meanings.
    • “Business Associate” shall mean Provider, or Datica Health, Inc.
    • “HITECH ACT” shall mean the Health Information Technology for Economic and Clinical Health Act.
    • “Individual” shall have the same meaning as the term “individual” in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).
    • “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.
    • “Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” in 45 CFR § 160.103, limited to the information received by Business Associate from or on behalf of Customer.
    • “Required By Law” shall have the same meaning as the term “required by law” in 45 CFR § 164.103.
    • “Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information, located at 45 CFR Part 160 and Subparts A and C of Part 164.
  3. Permitted and Required Uses and Disclosures.
    1. Service Offerings. Business Associate may use or disclose PHI for or on behalf of Customer as defined in the PaaS Agreement.
    2. Administration and Management of Services. Business Associate may Use and Disclose PHI as necessary for the sole purpose of the proper management and administration of Hosting Services. Any disclosures under this section will be made only if Business Associate obtains reasonable assurances from the recipient of the PHI that (i) the recipient will hold the PHI confidentially and will use or disclose the PHI only as required by law or for the purpose for which it was disclosed to the recipient, and (ii) the recipient will notify Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.
  4. Obligations of Business Associate.
    1. Limit on Uses and Disclosures. Business Associate will use or disclose PHI only as permitted by this BAA or as required by law, provided that any such use or disclosure would not violate HIPAA if done by a Covered Entity, unless permitted for a Business Associate under HIPAA.
    2. Safeguards. Business Associate will use reasonable and appropriate safeguards to prevent Use or Disclosure of PHI other than as provided for by this BAA, consistent with the requirements of Subpart C of 45 C.F.R. Part 164 (with respect to Electronic PHI) as determined by Business Associate and as reflected in the PaaS Agreement, which includes Disk Encryption and Encryption In-Transit services.
    3. Reporting. For all reporting obligations under this BAA, the parties acknowledge that, because Business Associate does not know the details of PHI contained in any of Customer Applications, there will be no obligation on the Business Associate to provide information about the identities of the Individuals who may have been affected, or a description of the type of information that may have been subject to a Security Incident, Impermissible Use or Disclosure, or Breach. Business Associate will ensure Customer access to Audit Logging to help Customer in addressing Customer’s obligations for reporting under this BAA. Customer acknowledges Business Associate is under no obligation to provide additional support for Customer’s BAA reporting obligations but may choose to provide such additional services at its sole discretion or at Customer expense.
    4. Reporting of Impermissible Uses and Disclosures. Business Associate will report to Customer any Use or Disclosure of PHI not permitted or required by this BAA of which Business Associate becomes aware.
    5. Reporting of Security Incidents. Business Associate will report to Customer on no less than fourteen business (14) days from the date any Security Incidents involving PHI of which Business Associate becomes aware in which there is a successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an Information System in a manner that risks the confidentiality, integrity, or availability of such information. Notice is hereby deemed provided, and no further notice will be provided, for unsuccessful attempts at such unauthorized access, use, disclosure, modification, or destruction, such as pings and other broadcast attacks on a firewall, denial of service attacks, port scans, unsuccessful login attempts, or interception of encrypted information where the key is not compromised, or any combination of the above.
    6. Reporting of Breaches. Business Associate will report to Customer any Breach of Customer’s Unsecured PHI that Business Associate may discover to the extent required by 45 C.F.R. § 164.410. Business Associate will make such report without unreasonable delay, and in no case later than four (4) hours after discovery of such Breach. Business Associate undertakes no obligation to report network security related incidents which occur on its managed network but does not directly involve Customer’s use of Hosting Services.
    7. Subcontractors. Business Associate will ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to restrictions and conditions at least as stringent as those found in this BAA, and agree to implement reasonable and appropriate safeguards to protect PHI.
    8. Access to PHI. Customer acknowledges that Business Associate is not required by this BAA to make disclosures of PHI to Individuals or any person other than Customer, and that Business Associate does not, therefore, expect to maintain documentation of such disclosure as described in 45 CFR § 164.528. In the event that Business Associate does make such disclosure, it shall document the disclosure as would be required for Customer to respond to a request by an Individual for an accounting of disclosures in accordance with 45 CFR §164.504(e)(2)(ii)(G) and §164.528, and shall provide such documentation to Customer promptly on Customer’s request. In the event that a request for an accounting is made directly to Business Associate shall, within 5 Business Days, forward such request to Customer.
    9. Accounting of Disclosures. Business Associate will make available to Customer the information required to provide an accounting of Disclosures in accordance with 45 C.F.R. § 164.528 of which Business Associate is aware, if requested by Customer. Because Business Associate cannot readily identify which Individuals are identified or what types of PHI are included in Customer Content, Customer will be solely responsible for identifying which Individuals, if any, may have been included in Customer Content that Provider has disclosed and for providing a brief description of the PHI disclosed.
    10. Internal Records. Provider will make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services (“HHS”) for purposes of determining Customer compliance with HIPAA. Nothing in this section will waive any applicable privilege or protection, including with respect to trade secrets and confidential commercial information.
  5. Customer’s Obligations:
    1. Appropriate Use of HIPAA Accounts. Customer is responsible for implementing appropriate privacy and security safeguards in order to protect PHI in compliance with HIPAA and this BAA. Without limitation, Customer shall: (i) not include protected health information (as defined in 45 CFR 160.103) in any Services that are not or cannot be HIPAA compliant, (ii) utilize the highest level of audit logging in connection with its use of all Customer Applications, and (iii) maintain the maximum retention of logs in connection with its use of all Services.
    2. HIPAA Account Appropriate Configurations: Customer is solely responsible for configuring, and will configure, all Customer Applications as follows:
    3. Encryption. Customer shall encrypt all PHI stored or transmitted outside the Services in accordance with the Secretary of HHS’s Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, available at http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html, as it may be updated from time to time, and as may be made available on any successor or related site designated by HHS.
    4. SSL Termination: All services must be served via SSL. Customer is responsible for providing, maintaining and updating a valid SSL certificate for use with the Service. SSL certificates must be a minimum of 4096 bit key size. Customer agrees to comply with Business Associate’s requirements regarding SSL termination.
    5. Necessary Consents. Customer warrants that it has obtained any necessary authorizations, consents, and other permissions that may be required under applicable law prior to placing Customer Content, including without limitation PHI, on the Services.
    6. Restrictions on Disclosures. Customer shall not agree to any restriction requests or place any restrictions in any notice of privacy practices that would cause Business Associate to violate this BAA or any applicable law.
    7. Compliance with HIPAA. Customer shall not request or cause Business Associate to make a Use or Disclosure of PHI in a manner that does not comply with HIPAA or this BAA.
  6. Term and Termination
    1. Term. The term of this BAA will commence on the PaaS Agreement Effective Date and will remain in effect until the earlier of the termination of the PaaS Agreement or notification by Customer that an account is no longer subject to this BAA.
    2. Effect of Termination. At termination of this BAA, Business Associate, if feasible, will return or destroy all PHI that Business Associate still maintains, if any. If return or destruction is not feasible, Business Associate will extend the protections of this Agreement to the PHI, limit further uses and disclosures to those purposes that make the return of the PHI infeasible, and make not further use or disclosure of PHI.
    3. If Customer requests contemporaneously with any termination event or notice, Business Associate will allow Customer to have access to Customer’s account for a reasonable period of time following termination as necessary for Customer to retrieve or delete any PHI at its then current monthly recurring rate; provided, however, that if the security of Customer’s servers has been compromised, or the Agreement was terminated by Customer’s failure to use reasonable security precautions, Business Associate may: (i) provide Customer with restricted access via a dedicated or private link or tunnel to Customer account or (ii) refuse to allow Customer to have access to Customer’s account but will use reasonable efforts to copy Customer data on to media Customer provides to Business Associate, and will ship the media to Customer at Customer expense. Business Associate’s efforts to copy Customer data onto Customer media shall be billable as an Additional Service at Business Associate’s then current hourly rates.
  7. No Agency Relationship. As set forth in the Agreement, nothing in this BAA is intended to make either party an agent of the other. Nothing in this BAA is intended to confer upon Customer the right or authority to control Business Associate’s conduct in the course of Business Associate complying with the Agreement and BAA.
  8. Nondisclosure. Customer agrees that the terms of this BAA are not publicly known and constitute Business Associate Confidential Information under the Agreement.
  9. Entire Agreement; Conflict. Except as amended by this BAA, the Agreement will remain in full force and effect. This BAA, together with the Agreement as amended by this BAA: (a) is intended by the parties as a final, complete and exclusive expression of the terms of their agreement; and (b) supersedes all prior agreements and understandings (whether oral or written) between the parties with respect to the subject matter hereof. If there is a conflict between the Agreement, this BAA or any other amendment or BAA to the Agreement or this BAA, the document later in time will prevail.
  10. Miscellaneous.
    1. Amendment. Customer and Business Associate agrees to take such action as is reasonably necessary to amend this HIPAA BAA from time to time as is necessary for either party to comply with the requirements of the Privacy Rule and related laws and regulations.
    2. Survival. Customer and Business Associate’s respective rights and obligations under this HIPAA BAA shall survive the termination of the Agreement.
    3. Interpretation. Any ambiguity in the PaaS Agreement shall be resolved to permit Customer to comply with HIPAA and the Privacy Rule.

SIGNATURE FOLLOWS

HIPAA Mappings to Datica Controls

Below is a list of HIPAA Safeguards and Requirements and the Datica controls in place to meet those.

Administrative Controls HIPAA Rule Datica Control
Security Management Process - 164.308(a)(1)(i) Risk Management Policy
Assigned Security Responsibility - 164.308(a)(2) Roles Policy
Workforce Security - 164.308(a)(3)(i) Employee Policies
Information Access Management - 164.308(a)(4)(i) System Access Policy
Security Awareness and Training - 164.308(a)(5)(i) Employee Policy
Security Incident Procedures - 164.308(a)(6)(i) IDS Policy
Contingency Plan - 164.308(a)(7)(i) Disaster Recovery Policy
Evaluation - 164.308(a)(8) Auditing Policy
Physical Safeguards HIPAA Rule Datica Control
Facility Access Controls - 164.310(a)(1) Facility and Disaster Recovery Policies
Workstation Use - 164.310(b) System Access, Approved Tools, and Employee Policies
Workstation Security - 164.310(‘c’) System Access, Approved Tools, and Employee Policies
Device and Media Controls - 164.310(d)(1) Disposable Media and Data Management Policies
Technical Safeguards HIPAA Rule Datica Control
Access Control - 164.312(a)(1) System Access Policy
Audit Controls - 164.312(b) Auditing Policy
Integrity - 164.312('c’)(1) System Access, Auditing, and IDS Policies
Person or Entity Authentication - 164.312(d) System Access Policy
Transmission Security - 164.312(e)(1) System Access and Data Management Policy
Organizational Requirements HIPAA Rule Datica Control
Business Associate Contracts or Other Arrangements - 164.314(a)(1)(i) Business Associate Agreements and 3rd Parties Policies
Policies and Procedures and Documentation Requirements HIPAA Rule Datica Control
Policies and Procedures - 164.316(a) Policy Management Policy
Documentation - 164.316(b)(1)(i) Policy Management Policy
HITECH Act - Security Provisions HIPAA Rule Datica Control
Notification in the Case of Breach - 13402(a) and (b) Breach Policy
Timelines of Notification - 13402(d)(1) Breach Policy
Content of Notification - 13402(f)(1) Breach Policy