Office 365 HIPAA Compliance is crucial for the healthcare industry as more and more entities are looking to secure their patient's sensitive information. The good news is corporate giants like Microsoft are making great investments and innovations in both robust security settings and HIPAA compliance for many of their most popular products.
Office 365 has been becoming the go-to name for the healthcare industry, and Microsoft is leaving no stone unturned as far as medical practices, HIPAA and IT Security are concerned.
So let's look into the top six features that make Office 365 HIPAA compliance great.
Microsoft will execute a HIPAA BAA that covers Microsoft365 & Office 365 HIPAA compliance. It's handled automatically by accepting their end-user license. You can check out their FAQ by downloading this pdf and going through the details.
Anyone who touches your sensitive data (PHI) is a HIPAA “Business Associate.” These Business Associates must sign an agreement promising to protect your patient data.
Microsoft365 handles sensitive emails, calendars, and documents. They are definitely considered a Business Associate by HIPAA.
Two-factor authentication is becoming much more common, considering the authenticity and security it provides to your data. You've probably seen this on other sites like online banking. You log in with your password, but then you need to enter a code from your phone or email to prove that it’s actually you.
We’re HUGE fans of the way that Microsoft does two-factor authentication while making Office 365 HIPAA compliance. Their smartphone app is well designed. You can approve your login right from your smartphone notification screen, like this:
This is way easier than entering a code or waiting for a text message to come in. You still have the choice to do both of these, but the app is fast and easy. And we’ve always found that the best security is the kind that doesn't slow you down.
In fact, we often help our customers set up the two-factor authentication process as we make them go through the Office 365 HIPAA Compliance process.
Microsoft has invested a lot in this area, and it shows. Data loss prevention stops your staff from accidentally emailing or sharing PHI. Let’s take a look at how DLP works in a HIPAA-compliant Microsoft365 setup:
Choose from existing premade templates covering your industry.
Best to leave them all turned on unless you have a reason not to.
In this example, it’s going to warn the user. If the user sends more than 5 pieces of information, they’ll get blocked.
Pretty slick, huh?
Like other cloud security providers, Microsoft has layers and layers of inside and outside auditors measuring their compliance and IT security measures. You can take a detailed look into their compliance norms by downloading this pdf.
Microsoft has done an amazing job giving customers visibility into the results of these audits to prove that Microsoft365 is HIPAA-compliant.
Here is a step-by-step guide on how you can set up your console.
In their admin console, you enter your location and industry:
Microsoft automatically shows you compliance reports relevant to your location and industry.
We can’t show you the details because they’re covered under NDA, but these two will give you an idea.
See exactly which IT security controls were audited, and whether they passed or failed:
Similarly, you can see the actual compliance reports for each service and each audit:
This is an excellent functionality for your auditors.
This is a new and impressive feature of the Office365 platform. Microsoft built a rules engine that lets you trigger alerts on certain conditions.
Here’s an example -- let’s say that you have employees that aren’t supposed to delete any files. You can set up an alert so that you’ll get notified any time someone deletes a file, and it’s as simple as this:
There are hundreds of “Activities” available on which to alert.
Office 365 has two cloud services for file sharing:
It can be TOO easy to accidentally share files with the public, and that would be a HIPAA breach.
Microsoft has made it simple to disable external sharing, preventing anyone from making this mistake.
Office 365 HIPAA Compliance can be a little complicated. However, that is something that you shouldn't worry about. Experts like Adeliarisk have been implementing Office 365 HIPAA Compliance for our clients for nearly a decade now. So if you feel you can use some helping hand, you can always reach out to us.