Your start-up is moving into the healthcare sector. Be careful, there are several points to watch with regard to the way you manage data.
Health data refers to any information linked to a person’s health, whether physical, mental or social. It can include medical information, clinical data, information on treatments, medical history, test results, medical images, information on allergies, medication taken, diagnoses, etc.
Health data is sensitive and confidential information, because it reveals personal details about a person’s health. Consequently, its collection, storage, use and sharing are generally regulated in order to guarantee the confidentiality and the protection of the privacy of individuals.
In France, it has to be stored in an environment (traditional host or Cloud Provider) certified HDS (health data hosting).
Let us look together at what that involves:
TABLE OF CONTENTS
- What is a health data host (HDS)?
- What are the obligations of an HDS in France?
- About AWS and its HDS certification
- How is the confidentiality of health data managed at AWS?
- How to achieve compliance easily with the BAM by Premaccess solution
Do you need more information? Contact us!
What is a health data host (HDS)?
A health data host is an entity or a company that provides health data hosting and management services. These are generally companies that specialise in the secure storage and management of medical and health data, in accordance with the regulations and security standards in force.
In France, there are several health data hosts that comply with the regulations on the protection of medical data.
What are the obligations of an HDS in France?
In France, a health data host (HDS) is subject to strict legal and regulatory obligations. Here are the main obligations an HDS has to comply with:
HDS approval: An HDS must obtain an approval issued by the Agence des Systèmes d’Information Partagés de Santé (ASIP Santé). This approval certifies that the host meets the technical and organisational requirements defined by ASIP Santé.
Security and confidentiality : An HDS is required to put in place appropriate security measures to protect the health data it hosts. This includes implementing access controls, cryptography, system monitoring, regular data backup, etc. Data confidentiality must also be guaranteed, preventing any unauthorised access or improper disclosure of the information.
Regulatory compliance: An HDS must comply with the regulations in force, in particular the Loi Informatique et Libertés, the General Data Protection Regulation (GDPR), the French law on the protection of health data (the amended “Informatique et Libertés” Act), as well as the recommendations of ASIP Santé.
Traceability and auditability: An HDS must put in place traceability and audit mechanisms making it possible to track access to the data, the operations carried out and any security breaches. This information must be retained and be available in the event of an inspection or an audit.
Backup and archiving: An HDS must ensure the regular backup of health data and the implementation of a business continuity plan in the event of a disaster. In addition, it is generally responsible for archiving the data in line with the legal retention periods.
Staff training: An HDS must train its staff on good security practice, data confidentiality and the legal obligations linked to the protection of health data.
These obligations are intended to guarantee the security, the confidentiality and the integrity of the health data hosted, as well as respect for patients’ rights and for data protection regulations. HDS providers are regularly audited to check their compliance with the requirements in force.
About AWS and its HDS certification
Amazon Web Services (AWS) also offers health data hosting (HDS) services in France through its AWS Healthcare Competency Program. It provides health data hosting and management solutions that comply with the regulations in force.
AWS offers a secure and reliable Cloud infrastructure for hosting health data. They provide services such as secure data storage, the implementation of access controls, identity and access management, as well as data encryption features. In addition, AWS provides compliance guarantees, in particular by meeting the requirements of the General Data Protection Regulation (GDPR) and of the ISO 27001 standard.
To be compliant with French regulations, AWS offers data centres in France (the AWS Europe Paris region). These data centres are located in France and allow customers to host their health data on French territory, thereby meeting data localisation requirements.
AWS adapts to all local data protection recommendations (GDPR in Europe, HIPAA in the USA, etc).
How is the confidentiality of health data managed at AWS?
AWS attaches great importance to data confidentiality, including where health data is concerned. They have put in place specific security measures and practices to guarantee the confidentiality of the data hosted on their platform. Here are some key elements of the management of health data confidentiality at AWS:
Access controls: AWS offers robust identity and access management features to control access to health data. This includes assigning role-based access privileges, two-factor authentication, access key management, and the ability to define specific security policies for AWS resources.
Data encryption: AWS offers powerful encryption services to protect health data. They allow encryption at rest (storage) and in transit (data transfer) using standard encryption mechanisms, such as AES-256 encryption. AWS also offers key management services to secure the encryption keys.
Logical separation of data: AWS uses a shared cloud infrastructure, but they ensure a logical separation of data between customers through virtualisation and isolation mechanisms. This guarantees that one customer’s health data is strictly separated and isolated from the other customers.
Regulatory compliance: AWS complies with data protection regulations, in particular the General Data Protection Regulation (GDPR), the HIPAA (Health Insurance Portability and Accountability Act) law in the United States, and other regulations specific to the healthcare sector. AWS provides compliance guarantees and makes audit documents and compliance attestations available.
Physical security: AWS puts in place physical security measures to protect the data centres where the data is stored. These measures include video surveillance, controlled access, fire suppression systems, intrusion protection, etc.
How to achieve compliance easily with the BAM by Premaccess solution?
It is important to note that responsibility for the security of health data is shared between AWS as the cloud services provider and the customers who use AWS services. Customers are responsible for configuring the services correctly, for managing access and permissions, and for protecting their applications and systems that use AWS services.
Our clients in healthcare ensure their compliance thanks to our expertise in this sector and our BAM Orchestrator solution. Natively, our solution makes it easier to bring infrastructures into compliance, taking standards and regulations into account, particularly in the healthcare sector.
Would you like to find out more? Contact us!