Microsoft’s latest cloud based service called Office 365 was recently released. More than 200,000 organizations participated in the beta testing period. Office 365 provides the following:

Microsoft Office, Microsoft SharePoint Online, Microsoft Exchange Online and Microsoft Lync Online in an always-up-to-date cloud service, at a predictable monthly subscription.

In addition, Microsoft is trying to target the healthcare industry by offering Business Associate Agreements (BAA). Microsoft is one of the first large organizations to offer a HIPAA BAA for their cloud based service.

Due to the requirements of HIPAA, the Health & Life Sciences industry requires privacy, security, and confidentiality of patient data (“protected health information”). With this in mind, Microsoft will be among the first in industry to offer a Business Associate Agreements (BAA) as an operationalized part of its solution to address requirements associated with hosting protected health information. Customers can obtain more information on BAA availability from their designated Microsoft account manager.

By offering a BAA it will make it easier for healthcare organizations to utilize the Office 365 cloud service. On the other hand, companies such as Google have not offered a BAA for their cloud based services. Microsoft has made a wise choice of offering the BAA and will make it easier for organizations to implement Office 365 and stay compliant with HIPAA regulations.

Let’s hope more cloud based services step up and offer Business Associate Agreements to customers.

There are two very disturbing trends regarding information security that should keep physicians and practice administrators up at night.

The first trend is that is seems like no company is safe from security breaches. Just yesterday Citigroup announced that they experienced a breach that involved more than 200,000 accounts.  Sony has been hacked repeatedly. Epsilon has experience a huge data breach.  These are multi-national companies that have the resources to protect data and yet they have been hacked and data has been breached.

The second trend is that hackers are starting to focus on smaller targets. In the Verizon 2011 Data Breach Investigations Report (PDF) they found that hackers are moving away from larger targets to smaller companies (tell that to the companies mentioned above).  The reason is that smaller companies have less security and are easier to hack.

Medical data has a very high value on the black market and it is only a matter of time until hackers turn their attention to medical practices. Medical practices typically don’t invest a lot of money in security and many are not compliant with HIPAA Security regulations. The chances that hackers are successful when they focus on medical practices is probably pretty high. In addition, the costs of security breaches are increasing and HIPAA enforcement and fines are also increasing.

Physicians and practice administrators need to be aware of these disturbing trends. Security and HIPAA compliance is essential and needs to be focused on now before it is too late.

Image: digitalart / FreeDigitalPhotos.net