Office 365 HIPAA-Compliance - 6 best features and how it works?

Office 365 HIPAA Compliance is crucial for the healthcare industry as more and more entities are looking to secure their patient's sensitive information. The good news is corporate giants like Microsoft are making great investments and innovations in both robust security settings and HIPAA compliance for many of their most popular products.

Office 365 has been becoming the go-to name for the healthcare industry, and Microsoft is leaving no stone unturned as far as medical practices, HIPAA, and IT Security are concerned.

So let's look into the top six features that make Office 365 HIPAA compliance great.

Is Your Office 365 HIPAA Compliant and Secure? Don’t Wait for a Breach, Start your cloud security journey with our comprehensive audit.. Our specialists are committed to helping your business stay safe and seamlessly achieve HIPAA compliance and encryption requirements.

Office 365 HIPAA-Compliance business associate agreement

Microsoft will execute a HIPAA BAA that covers Microsoft 365 & Office 365 HIPAA compliance. It's handled automatically by accepting their end-user license.  You can check out their FAQ by downloading this PDF and going through the details.

Download HIPAA FAQ for Business Associate Agreement Info

Anyone who touches your sensitive data (PHI) is a HIPAA “Business Associate.” These Business Associates must sign an agreement promising to protect your patient data.

Microsoft 365 handles sensitive emails, calendars, and documents.  They are definitely considered a Business Associate by HIPAA.

Office 365 HIPAA Compliance two-factor authentication

Two-factor authentication is becoming much more common, considering the authenticity and security it provides to your data.  You've probably seen this on other sites like online banking.  You log in with your password, but then you need to enter a code from your phone or email to prove that it’s actually you.

We’re HUGE fans of the way that Microsoft does two-factor authentication while making Office 365 HIPAA-compliant.  Their smartphone app is well-designed.  You can approve your login right from your smartphone notification screen, like this:

This is way easier than entering a code or waiting for a text message to come in.  You still have the choice to do both of these, but the app is fast and easy.  And we’ve always found that the best security is the kind that doesn't slow you down.

In fact, we often help our customers set up the two-factor authentication process as we make them go through the Office 365 HIPAA Compliance process.

Data Loss Prevention

Microsoft has invested a lot in this area, and it shows.  Data loss prevention stops your staff from accidentally emailing or sharing PHI.  Let’s take a look at how DLP works in a HIPAA-compliant Microsoft365 setup:

• First, set up a policy.

Choose from existing premade templates covering your industry.

• Look into all the Microsoft 365 services the policy covers

Best to leave them all turned on unless you have a reason not to.

• Next, Customize the types of sensitive data you want to protect

• Finally, let’s tell it what to do

In this example, it’s going to warn the user.  If the user sends more than 5 pieces of information, they’ll get blocked.

Pretty slick, huh?

Office 365 HIPAA-Compliance is completely transparent

Like other cloud security providers, Microsoft has layers and layers of inside and outside auditors measuring their compliance and IT security measures. You can take a detailed look into their compliance norms by downloading this pdf.

Download Compliance Norms

Microsoft has done an amazing job giving customers visibility into the results of these audits to prove that Microsoft 365 is HIPAA-compliant.

Here is a step-by-step guide on how you can set up your console.

In their admin console, you enter your location and industry:

Microsoft automatically shows you compliance reports relevant to your location and industry.

We can’t show you the details because they’re covered under NDA, but these two will give you an idea.

• Status of Audited Controls

See exactly which IT security controls were audited, and whether they passed or failed:

Compliance Reports

Similarly, you can see the actual compliance reports for each service and each audit:

This is an excellent functionality for your auditors.

Configurable alerts

This is a new and impressive feature of the Office365 platform.  Microsoft built a rules engine that lets you trigger alerts on certain conditions.

Here’s an example -- let’s say that you have employees that aren’t supposed to delete any files.  You can set up an alert so that you’ll get notified any time someone deletes a file, and it’s as simple as this:

There are hundreds of “Activities” available on which to alert.

Prevent accidental breaches

Office 365 has two cloud services for file sharing:

• Sharepoint (for team file sharing)
• OneDrive (for personal file backup and sharing)

It can be TOO easy to accidentally share files with the public, and that would be a HIPAA breach.

Microsoft has made it simple to disable external sharing, preventing anyone from making this mistake.

Office 365 HIPAA Compliance can be a little complicated. However, that is something that you shouldn't worry about. Experts like Adeliarisk have been implementing Office 365 HIPAA Compliance for our clients for nearly a decade now. So if you feel you can use some helping hand, you can always reach out to us.

Get some free help!  Check out our free guide for 17 Tips to Make Microsoft365 HIPAA-Compliant. You can also reach out to our Twitter account for more details on Office 365 compliance.