In this Armor review I will take a in-depth look into their HIPAA compliant hosting solution. I will go through their product offering, and their included services and level of support. And I will make a sample price calculation for a typical server offering. I also sent Armor a couple of questions to get to know them and their solutions even better, and you will find their answers in this Armor review.

HIPAA Compliant Hosting Setup

Armor has HIPAA compliant hosting running through it’s veins. They pride themselves in providing the most secure cloud hosting solution, and this is something you see coming back in their product offering.

A typical setup will include:

• 2 HIPAA Secure Servers with 1 Core, 1 GB memory and 30 GB of SAN storage
• The Armor management layer with advanced protection and monitoring, and multiple security features
• HIPAA requirements like Two-Factor Authentication and SSL
• Log management and monitoring
• Vulnerability Monitoring, pro-actively scanning for hacking attempts

Included services and level of support

As you can see from the list above, Armor offers a whole range of included services. Actually about 75% of the total monthly fee for this setup  is spent on server management, monitoring and enhanced security. Any service they offer is focused in being fully HIPAA compliant, including their data center itself.

Healthcare is a major part of Armor business, and a part they take really serious. You can read more about their solution on the Armor Healthcare Portal.

All of their support staff is trained in HIPAA compliance, and available 24×7.

Sample price calculation

The setup described above is the basic entry level setup. If you host it in a US data center it will cost you $1.115 per month. This is without the 5% discount you receive when you use the offer you find on this page. This discount will account for a reduction of $55 per month.

A more powerful configuration with each server having 4 processor cores and 8 GB of memory will bring you to a total of $1.755 per month. In this case your discount will be $87 per month (see terms & conditions).

Conclusion of this Armor review

With Armor you not so much order a few servers with some server management. What you get is a full package of security measures, monitoring and management to ensure you receive and maintain your HIPAA certification.

Armor is moderately priced, and their entry-level configuration pricing is even very competitive. Don’t forget to use our promotion to receive your 5% monthly discount for the first 24 months.

Armor Interview:
4 Questions to get to know them better

1) Why should healthcare organizations and businesses choose Armor for their HIPAA-compliant hosting solution?

Armor provides the most comprehensive secure cloud infrastructure to support your HIPAA needs. As a HITRUST-certified hosting provider, bringing your application to Armor will ensure that you can focus on your business and leave the infrastructure, OS, and Managed Security to Armor .

Armor’s 5 global data centers are all included in the scope of our compliance audits. Other providers may only meet the HIPAA guidelines up to the physical security layer – which is the most basic level of compliance – the problem is that the rest of the compliance responsibility falls on the customer. Armor’s secure infrastructure reduces the scope and burden of an audit on customers and helps address ever-increasing compliance requirements.

Compare the real cost of bolt-on security, server management, support and audit fees to other cloud providers – Armor’s value is unbeatable.

2) Do you employ HIPAA-trained support staff, or have other means of answering technical HIPAA questions?

Armor’s 24×7 Technical Assistance Center, Security Operations Center, and Network Operations Center all have HIPAA specific training that allows them to assist customers with questions regarding HIPAA requirements.

Armor’s compliance team even assists when customers are going through self- assessments and 3rd party or vendor audits to ensure all of the Armor-provided audit controls are understood by assessors. Many cloud providers do not have personnel and teams with this security expertise. Armor does, and it is a major differentiator.

3) To what extent can you help a customer become HIPAA-certified?

We offer fully secure infrastructure. In addition we offer HIPAA-compliance solutions, such as the Health Data Repository, that provide a protected domain for sensitive healthcare information. Customers just need to bring their applications and be responsible for how their applications handle their data.

Armor’s Health Data Repository greatly simplifies compliance scope and difficulty for customers. Once a customer goes into the audit process – Armor’s Security and Compliance teams are there to assist with any questions.

4) How does the sales process work?
What happens after a customer contacts you to discuss a HIPAA compliant hosting solution?

Customers are guided through a process of requirements gathering, solution architecture and deployment planning that allows an environment to be fully provisioned and tested well ahead of their launch date.
Armor provides HIPAA-compliant solutions and solution expansions delivered within 24 hours of order placement.

Thank you Armor for this interview!

And this concludes this Armor review. If you have additional questions, please leave them in the comment section.

Read other HIPAA Hosting Reviews:

Armor Review – HIPAA Compliant Hosting
Liquid Web Review – HIPAA Compliant Hosting
SingleHop Review – HIPAA Compliant Hosting

Becoming HIPAA compliant requires a lot of changes and implementations for your organization. Use our HIPAA Security Rule Compliance Checklist to easily check what is done and what requires attention. Download the PDF.

Introduction to the HIPAA Security Rule Compliance Checklist

If your organization works with ePHI (electronic protected health information), the U.S. government mandates that certain precautions must be taken to ensure the safety of sensitive data. The penalties for not complying with these legal requirements set forth by HIPAA can be severe: criminal charges, up to $1.5 million in fines, and liability in civil suits. As such, it is of paramount importance that all entities covered by HIPAA’s stipulations engage in periodic compliance checks.

In this article, we will briefly outline all the requirements your organization must satisfy to be considered compliant to the Act.

The purpose of this checklist is to present HIPAA’s dense, and oftentimes, confusing requirements in more accessible language.

Keep in mind that, unlike the highly specific legal language used in the Act, layman explanations are more legally ambiguous. As such, do not treat this article as an exact, one-to-one translation of the legal stipulations.

What this checklist CAN do for your organization: expand an employee’s/subcontractor’s understanding of HIPAA requirements, provide security officers with a general guideline for the policies and procedures that must be covered in compliance reports, and act as a launching point for a new compliance plan.

What this checklist CANNOT do for your organization: replace the proper legal due diligence required for true HIPAA compliance.

2.0 – HIPAA Administrative Safeguards Checklist

The backbone of a covered entity’s internal policies, HIPAA’s administrative safeguards require your organization to establish procedures that ensure security measures are adequately planned, developed, implemented, maintained, and managed. There are a total of 9 administrative safeguard standards, each of which has one or more implementation requirement(s).

To be compliant with HIPAA’s administrative safeguard requirements, ensure that your organization has implemented the following standards:

2.1 – Security Management

This standard requires your organization to implement policies for the detection, prevention, and containment of security violations.

Have you conducted a comprehensive risk assessment of potential vulnerabilities to confidentiality, integrity, and availability of ePHI?

Do you have policies for sanctioning employees who fail to comply with proper security procedures?

Have you implemented procedures to review activity of systems where ePHI is stored (audit logs/access logs/security incident reports)?

2.2 – Assigned Security Responsibility

Have you identified a security official to be responsible for developing and implementing security policies and procedures?

2.3 – Work Force Security

This standard is meant to ensure that your organization has procedures in place to grant access to ePHI when it is appropriate.

Do you have policies in place for authorizing and supervising employees/subcontractors who work with ePHI?

Have you established clearance procedures on how a worker’s access to is granted or denied ePHI?

Do you have a clear procedure for terminating a workforce member’s access to ePHI?

2.4 – Information Access Management

If your organization is a subsidiary/part of a larger organization, do you have procedures that prevent the larger organization(s) from accessing ePHI?

Are clear policies in place describing how, when, and where access to ePHI can be granted?

Have you instituted procedures to consistently document and review a user’s access to ePHI?

2.5 – Security Awareness and Training

Do you publish periodic security updates and reminders for your workforce?

Are there policies in place to ensure that your workstations, servers, and digital systems have adequate protections from malicious software?

Have you implemented monitoring procedures for user logins and suspicious activity?

Have you established strict policies for the creation, modification, and protection of secure passwords?

2.6 – Security Incident Procedures

Does your organization have procedures in place for responding to security incidents, mitigating their effects, and documenting them?

2.7 – Contingency Plan

In case of emergencies (like fire, natural disasters, system malfunctions, etc.) your organization must have codified contingency plans to ensure the safety of ePHI.

Do you have a data backup plan for retrieving exact copies of lost or damaged ePHI?

Have you implemented data restoration procedures?

Does your organization have procedures in place that would allow processes critical to the security of ePHI to continue in the event of an emergency?

Do you conduct periodic testing and revisions of contingency plans?

Have you conducted an assessment to determine the data and applications that are critical to your contingency plans?

2.8 – Evaluation

Does your organization conduct periodic evaluations of established policies and procedures to ensure that they continue to adequately protect ePHI?

2.9 – Business Associate Contracts

A Business Associate is anyone who handles ePHI on your organization’s behalf (email providers, server hosts, messaging services, clearinghouses etc.).

Are your business associates compliant to HIPAA standards?

Have you documented the relevant safety assurances through a written contract (Business Associates Agreement)?

3.0 – HIPAA Physical Safeguards Checklist

The second category of HIPAA’s Security Rule outlines all the required measures a covered entity must enact to ensure that physical access to ePHI is limited only to appropriate personnel.

3.1 – Facility Access Controls

Do you have procedures in place to grant appropriate personnel (e.g. data recovery specialists) access to your facilities in the event of an emergency?

Has your organization enacted policies and procedures to protect the facility and its equipment from unauthorized access, tampering, and theft?

Have you implemented procedures for validating a person’s right to access your facilities, workstations, and software?

Are policies in place to ensure that all repairs and modifications of physical security components (doors, locks, etc.) are carefully documented?

3.2 – Workstation Use

Have you established clear policies and procedures that outline the manner in which workstations must be used to ensure the safety of ePHI?

3.3 – Workstation Security

Do you have physical safeguards in place to ensure that only authorized personnel have access to workstations with ePHI?

3.4 – Device and Media Controls

Has your organization established clear procedures for safely disposing of ePHI and/or the hardware it is stored on?

Have you implemented policies requiring complete removal of ePHI from storage mediums (hard drives, flash storage, etc.) before they can be reused?

Does your organization document the movement of digital media containing ePHI?

Have you established procedures to safely backup ePHI prior to the movement of the hardware it is stored on?

4.0 – HIPAA Technical Safeguards Checklist

The last section of HIPAA’s Security Rule outlines required policies and procedures for safeguarding ePHI through technology. Although exact technological solutions are not specified, they should adequately address any security risks discovered in the assessment referred to in section 2.1 of this checklist, and comply with established system review procedures outlined in the same section.

4.1 – Access Control

Does your organization assign unique usernames/number identifiers to all workforce members who have access to ePHI?

Are there procedures in place to ensure that the appropriate individuals can access ePHI in the event of an emergency?

Are users automatically logged out of systems containing ePHI after a set time of inactivity?

Has your organization implemented policies for encryption/decryption to prevent unauthorized entities from accessing ePHI?

4.2 – Audit Control

Has your organization implemented reasonable audit controls (software/hardware/procedural) to record and assess the activity of systems containing ePHI?

4.3 – Integrity Control

Have you implemented technical processes (check-sum verification, digital signatures, etc.) to verify that ePHI is not being altered in an unauthorized manner?

4.4 – Person or Entity Authentication

As per the risk assessment, has your organization implemented adequate methods for ensuring that individuals trying to access ePHI are who they say they are?

4.5 – Transmission Security

Has your organization implemented adequate solutions (e.g. network communication protocols) to ensure that transmitted ePHI cannot be modified without detection?

As per the risk assessment, is your organization encrypting ePHI when it is necessary for the security and integrity of the data?

5.0 – Final Considerations

Recognizing that a wide range of organizations store, transmit, and use ePHI, HIPAA’s Security Rule is intentionally vague at times; there is no single solution that covers every possibility. The language of the Act is clear in other ways—the onus of determining adequate protections is on the covered entity.

Depending on the unique structure of your organization, you may not necessarily need to follow every stipulation outlined in the Act. Or conversely, you may be legally required to take measures not specifically mentioned in HIPAA. This will be determined by the results of your risk assessment.

As such, there are a few more considerations you should make to ensure your organization is compliant to HIPAA:

Where applicable, were all vital assessments conducted by contractors/businesses with adequate security expertise?

If certain stipulations were deemed inapplicable to your organization, have you adequately demonstrated this in your compliance documentation?

Has all relevant compliance information (policies, procedures, assessment results, security reports, audit reports, etc.) been adequately documented?

Does your organization periodically reassess its HIPAA compliance?

Has a HIPAA lawyer assessed your organization’s compliance reports?

Download the PDF.

We all have compounding daily, weekly and monthly tasks that get pushed back due to the fires you have to put out right now. But, eventually those seemingly insignificant tasks have to be addressed.

This is a guest post written by Chad Kissinger, Founder of OnRamp.

For many in healthcare and healthcare technology, preparing for phase II of the HIPAA Audit Program is one of those tasks that gets pushed off until it’s too late. Any business that operates within the lawful confines of HIPAA, should already have matters well in order, but it’s a complex process that requires vigilance and constant attention to stay up-to-date with regulation.

The Department of Health and Human Services (HHS) started sending out notifications to Covered Entities (CEs) and their Business Associates (BAs) via email in April of 2016.

The Compliance Enforcement Index reported:

“The Office for Civil Rights (OCR) has begun to obtain and verify contact information to identify covered entities and business associates of various types and determine which are appropriate to be included in potential auditee pool […] If a covered entity or business associate fails to respond to information requests, OCR will use publicly available information about the entity to create its audit pool. An entity that does not respond to OCR may still be selected for an audit or subject to a compliance review.”

The OCR notes that it’s your organization’s responsibility to respond to their email within the given time limit. The only covered entities and business associates exempt from this round of auditing are “entities with an open complaint investigation or that are currently undergoing a compliance review organizations exempt.”

Don’t Panic. Be Sure You’re Prepared

We shared a few things that would help you prepare for this phase of audits—and the simplest and most critical action to take now is to ensure that you have whitelisted OSOCRAudit@hhs.gov. The last thing you want is to have notices go to your spam folder!

The OCR clearly stated that they expect you to be aware of their first round of notices, as well as any subsequent emails. And because you only have 14 days from initial contact to verify information and ten days from any contact to address audits, time is of the essence. Once you check to make sure that you’ve whitelisted their email domain, we recommend double checking your spam filters. Then, make sure the contact information you provided the OCR is still valid.

According to the sample letter posted on the HHS site, “If we [OCR] do not receive a response from you, we will use this email address for future communications with this entity. Failure to respond will not shield your organization from selection.” The OCR’s email notifications include a deadline for responding to their request for verification of your contact information. The deadlines for response may have already passed, so if you have not responded to the OCR’s first notification, the default is that they will send future notices to this email address.

The first round of desk audits will start with Covered Entities, followed by Business Associates. Those audits started in 2016 will likely continue into next year; some organizations must endure detailed reviews and are subject to onsite reviews.

An Increase in Federal Budget for the OCR Means More Resources… and More Audits

President Obama’s proposed budget for the fiscal year 2017, includes $1.15 trillion for HHS, an increase of 3% from 2016’s fiscal budget. The OCR is set to receive $43 million, versus $39 million from 2016 and 2015. The purpose of the funding is to aggressively pursue auditing to ensure that both Covered Entities and Business Associates are take HIPAA compliance seriously. (Because Congress approves these budget allocations, this strategy shows their priority for funding.)

Alongside the email notifications that began in April of 2016, the OCR published an audit protocol to help organizations prepare for the audits, regardless of how the audits were triggered. Some were part of phase 2 of the HIPAA Audit Program while others were part of a consumer complaint or breach report. There are 180 areas of scrutiny in the protocol. Be warned: You will need to have your documentation and requested materials organized and ready should you be selected for an audit.

The Right Partnerships Are Critical

The key takeaway from the HIPAA Omnibus Rule is that BAs and their subcontractors are directly liable for HIPAA compliance, including security breaches. If you outsource your cloud storage or use a managed service provider to create, transfer, or store your HIPAA-regulated data, you’ll want to take note. Your provider must be able to prove compliance, and if they are not able to demonstrate this to you, please change providers immediately.

As mentioned, there are approximately 180 different areas that may be addressed in an audit. The OCR’s audit protocol specifically notes: “Entities must provide only the specified documents, not compendiums of all entity policies of procedures. The auditor will not search for relevant documentation that may be contained within such compilations.” This means that a high-level overview or similar documents are not acceptable.

Organization is Key

If you haven’t already, it’s important that you organize all relevant audit documentation and develop training programs for employees, contractors, and partners to ascertain that they’re aware of their role in your organization’s compliance. Don’t forget to see how your partners and providers will prove they’re compliant, too. These are just a few ways to prepare for a compliance audit. Depending on the size and nature of your organization, you may be held to additional requirements.

Non-compliance can result in fines, required remediation, legal costs, loss of reputation, and may even cause your business to permanently close. Even if you’ve made it to this point without an audit, it’s only a matter of time before it’s your turn. Keep your documentation and processes up to date and continue to improve upon your compliance.

Feel free to visit the HHS Compliance website for more information.

Source: This article was originally published on the OnRamp blog.

It’s not uncommon to turn on the morning news and hear about another company whose information has been compromised. We are living, and working, in a cyber-world and cyber-crime exists as a fact of life for those of us who use computers.

This is a guest post written by Laura Miller, Compliance Manager of Aspida.

With most of our businesses operating on a network infrastructure relying on access to the Internet, additional steps and practices need to be implemented in order to protect yourself and your patients.

One of these vulnerabilities to address is email. Email is convenient. We can receive messages on our computers, mobile devices, tablets, and respond at our leisure. Due in part to its ease, it is a preferred form of communication for many people. With this ease come inherent risks.
An email is comparable to a postcard. Its contents are susceptible to being viewed by individuals other than the intended recipient. As a Covered Entity, you are responsible, by HIPAA law, for safeguarding your patient’s data.

Anytime electronic Protected Health Information (ePHI) is being sent in an email, HIPAA recommends implementing procedures to ensure secure transmission and storage. The easiest way to do this is to utilize an encrypted email system.

Ideally, look for a provider that offers the option to send regular vs. encrypted mail. For example, Aspida Mail, is triggered by a keyword, encrypt in the subject or body of an email. If that keyword is omitted, all emails flow as usual.

Additionally, if you are receiving ePHI to your email, verify you are implementing secure storage procedures. Typically, (free) Gmail, Aol & Yahoo Mail do not store securely.
Aspida Mail takes over your existing mail server – ensuring secure storage of all mail messages.

Additional tips:
Opening Emails
• Use a mail solution that has antivirus and a robust spam filter enabled.
• Inspect all email messages thoroughly, including the sender’s address.
• Do not open any email that looks suspicious. If you do not know the sender, treat it as suspicious email.

Sending Emails
• Confirm the email address with which you are sending information.
• Do not put any ePHI in the subject line of an encrypted email – this information is still transmitted through an unsecure environment.

By familiarizing yourself and your team about these email procedures, you’ve taken the first steps to protection. The next step would be to figure out what works best for your practice and come up with a plan for implementation. And don’t forget, documentation of all policies and procedures is key!

Special offer for Aspida Mail:
Try the First Three months for $3! Aspida offers a 30 day money back guarantee, month to month contracts and risk free cancellation!
Use HIPAAHQ in the “Promotional Code” box in the shopping cart.
Click here to learn more about their product.

This is a paid review performed by an independent writer, according to our guidelines.
See full disclosure the at the bottom of this article.

OnRamp Company Bio

Founded in 1994, OnRamp saw humble beginnings as an ISP retailer in an Austin mall kiosk. Originally providing local businesses with dial-up, ISDN, and T1 connections, OnRamp quickly expanded their service offerings to colocation hosting and web development.

Within a few years, OnRamp had become a one-stop-shop for local businesses looking to bring their operations to the Web.

By 1998, OnRamp began work on its first purpose-built state of the art data center in Austin, Texas. This project marked the budding company’s transition into a hosting-focused model, which it has maintained to this day.

In 2003, OnRamp relocated its operations to a newly acquired data center in Austin. Beyond the additional square-footage, the new data center boasted an upgraded 2N power distribution design—a cutting-edge redundancy measure that safeguarded their servers from power failures.

In 2007, OnRamp launched one of the first commercial private clouds in America.

In 2013, OnRamp opened its first data center in Raleigh, North Carolina. And in the following year, they opened a second enterprise-class data center in Austin, Texas.

OnRamp’s Foray into HIPAA Compliance

More than 29.3 million patient records have been compromised in security breaches since 2009. Recognizing these breaches were part of a growing trend, the United States Government revised its ePHI laws in 2011 with the HITECH Act. These expanded laws placed a greater responsibility on covered entities and their business associate counterparts to keep data secure and significantly increased penalties (up to $1.5 million annually) for non-compliance.

Despite the new laws and several high-profile class-action lawsuits, HIPAA data breaches increased 138% since 2012.

The number one culprit according to experts: covered entities are failing to conduct regular risk analyses and update their policies.

Building upon their expertise in secure IT infrastructure for a variety of highly regulated industries (credit card processing, financial, international commerce, etc.), OnRamp began offering HIPAA compliant hosting services in 2012. Combining cutting-edge security measures, a highly trained team of IT professionals and compliance experts, and a proprietary Risk Management Tool, OnRamp launched one of the most powerful and comprehensive HIPAA compliant hosting services available.

OnRamp Service Overview

Available Services

While HIPAA hosting is a key aspect of OnRamp’s business model, the company provides hosting for a variety of regulatory frameworks (PCI, GLBA, FISMA, FERPA, SOX and more). Because each industry is unique and no two clients are identical, OnRamp’s service list is all encompassing.

• Managed Hosting: dedicated servers, private clouds
• Cloud delivered services: managed storage, backups, and devices
• Colocation: compliant and enterprise colocation
• Managed security services: network firewalls, VPNs, encrypted storage, encrypted backups, malware protection, file integrity monitoring, web application firewalls, two-factor authentication, vulnerability scanning, log management, and intrusion detection

Each client’s IT architecture is a unique combination of the above services, tailor-made for their specific needs. This is true “hybrid” hosting.

HIPAA Compliance

Unlike PCI-DSS hosting providers (where validation of compliance is performed by a central authority), virtually any hosting provider with decent security can claim to be HIPAA compliant. This is because there is no recognized certification standard for compliant hosting, and the onus for ensuring that data is both stored and transmitted securely lies solely on those deemed covered entities or business associates by law.

In other words—no matter how fancy a host’s security systems are—the liability for compliance is still yours.

As such, a good HIPAA hosting provider should provide more than just security. It should assist clients in building compliant IT infrastructures. It should educate clients on industry best practices. And it should provide the necessary compliance support when needed.

OnRamp does all of this, and a whole lot more.

Full7Layer Support

This is OnRamp’s first major distinction in the HIPAA hosting sphere. Whereas most hosting companies provide support for only a portion of your IT environment (data center, network, device, and virtualization), OnRamp provides 24/7/365 support for all 7 layers of your IT environment:

1. Data center
2. Network
3. Device
4. Virtualization
5. Operating system
6. Application framework
7. Intelligence & monitoring

By subscribing to OnRamp services, you are also hiring a team of highly trained IT and HIPAA professionals to assist you in every facet of compliant network management and maintenance.

Risk Management Tool

Unique to OnRamp, the Risk Management Tool is an excellent addition to all of their HIPAA hosting packages. Accessible through an in-browser portal, this proprietary process can be broken down into three steps:

1. Information Collection
   The most straightforward step—here OnRamp collects information about IT infrastructure requirements by guiding users through a simple questionnaire.
2. Risk Assessment
   After the necessary information has been collected, OnRamp identifies potential risks and vulnerabilities in your IT infrastructure in relation to HIPAA and HITECH stipulations.
3. Risk Management
   The final step provides users with actionable documentation for addressing all discovered vulnerabilities, outlining the necessary steps for ensuring compliance in their IT infrastructure.

Upon completion of the process, OnRamp’s Risk Management Tool generates several important documents for its users.

• A summary report outlining all of the information collected throughout the process
• A system diagram that visualizes your unique IT environment
• A new BAA based on any service/environment changes

This tool takes the guesswork out of compliance, giving you a bird’s eye view of your entire IT environment and its vulnerabilities.

Customer Service

To get a sense for OnRamp’s level of customer service, I went through their entire consultation process pretending to be a prospective client.

Less than 10 minutes after I had filled in a short form on their website, a friendly OnRamp receptionist called me. After inquiring about a few specifics (what kind of company am I representing, how quickly do I need the services set up, etc.), she put me in touch with the specialist she deemed best suited to address my hosting needs.

Following a short hold, another friendly voice greeted me by my fake name. We exchanged pleasantries and quickly dove into the deep end.

Despite having written down a dozen questions to ask the sales team, I found myself doing most of the answering.

The OnRamp representative wanted to know more about my company.

What kind of work were we doing? What sort of applications would we be running? How many users will need access? Do we have our own disaster recovery plan?

I answered as best I could, but grew exceedingly vague in my responses (I hadn’t thought that far ahead). When I couldn’t answer, he elaborated and made excellent suggestions.

“Do you have any questions or concerns?” he asked me after collecting a sufficient amount of data.

In the process of building my profile, the OnRamp representative had inadvertently answered every single question I had written down (and many more that I hadn’t.) Disarmed, I fired off whatever softball questions came to mind. He answered them all with ease.

When I could think of nothing else, we thanked each other and said our goodbyes.

Within a few minutes, I received an email from OnRamp detailing my suggested hosting plan. Everything from detailed hardware specs, software choices, and security solutions was outlined in the document.

I also received a 14-page PowerPoint-styled overview of OnRamp’s services and a 12-page whitepaper explaining HIPAA compliance in some detail.

The entire experience was pleasant, professional, and enormously educational.

Expertise

While dozens of hosting companies have jumped on the HIPAA bandwagon in the last decade, few can demonstrate the level of expertise found at OnRamp.

Before you even begin your free consultation, OnRamp provides you with a wealth of HIPAA resources—blogs, news articles, infographics, and videos—to educate you on all matters compliance.

OnRamp regularly posts case studies and free whitepapers about attaining HIPAA compliance.

They offer helpful articles about becoming compliant; such as checklists for choosing the right HIPAA cloud hosting, tips on incorporating personal devices in the workplace, and compliance tips for developers.

They also sponsor health-industry conferences to educate attendees about HIPAA compliance.

In short: OnRamp is an excellent compliance resource, and an undisputed leader in compliant hosting expertise.

OnRamp Technical Overview

Data Centers

OnRamp owns and operates three separate enterprise-class datacenters: two in Austin, Texas and one in Raleigh, North Carolina.

OnRamp’s data centers use 2N power architecture to ensure maximal uptime. By running two parallel yet independent power configurations, OnRamp’s facilities can function even in the case of a power-grid failure. In the extreme case of a total outage, including a power-grid failure, OnRamp’s redundant generators are equipped with enough fuel onsite to generate electricity for up to 48 hours (with the potential to keep refueling indefinitely).

Network outages are equally unlikely in OnRamp’s facilities, given their utilization of mesh networking, dedicated links between facilities, and redundant fiber delivery from multiple Tier 1 backbone providers.

This combination of power and network redundancies gives OnRamp an unbeatable 100% uptime—24/7/365.

OnRamp also happens to run one of the most secure facilities in the world.

• Fully SSAE 16 SOC 2 compliant
• Bulletproof mantrap entrances
• Biometric scanners
• 24/7/365 surveillance
• Two-factor authentication at vital entry points
• Individually locking and audit-traceable racks
• Around-the-clock onsite NOC personnel
• A variety of other physical and logical security systems

This level of security goes above and beyond what is expected of HIPAA compliant organizations, and there is simply no safer place for your data to be.

It is also important to reiterate, unlike many smaller HIPAA compliant hosts, OnRamp runs their own data centers. They are not renting out racks from another company. There is no middleman. This gives you several key advantages:

• All the support staff (from your data center layer to your monitoring layer) are on the same page
• Support escalation and issue resolution are as quick as can be
• Everyone with access to your servers is trained in HIPAA compliance
• Government auditors can be granted full access to the facilities

Hardware

As expected, OnRamp facilities boast some of the best technologies in the IT space. They offer HP and Dell enterprise-class servers, SolidFire SSD storage, and Cisco networking gear. While the specs are entirely dependent on your firm’s requirements, the potential configurations are virtually limitless.

Software

As is the standard for enterprise-class providers of virtualization, OnRamp servers run VMWare vSphere.

OnRamp supports a wide variety of Linux, Unix, and Windows server OS’s.

OnRamp HIPAA Compliant Hosting Services

The standard approach to hosting has become one of standardization; tiered pricing structures, packaged services, and all-encompassing solutions. Sure, every hosting provider offers some level of customization—but it must be explicitly requested in most cases (and is usually not without some caveats).

OnRamp strays from the pack in this regard—they recognize that one size does not fit all.

From the moment of your first consultation, OnRamp begins engineering a unique hosting solution for you. Nothing is assumed. From hosting type (dedicated, private cloud, colocation), hardware (CPU, RAM, storage, bandwidth etc.), software (operating systems, applications, etc.), and security (firewalls, disaster recovery, monitoring etc.), every facet of the solution is custom-designed with your specific requirements in mind.

What kind of applications will you be running on the servers? How many people will be accessing the data at once? Does your organization keep its own backups?

No stone is left unturned.

For serious health organizations that have done the proper due diligence (security assessments, internal audits, etc.), this level of granularity is a must. Not every HIPAA stipulation applies to all organizations equally. In some cases—assuming your organization can prove it with the required audits and documentation—some rules may not even be applicable. In other cases, your organization may be required to take additional steps to secure its ePHI.

With OnRamp, you don’t have to be an IT expert to find the best solution for your organization. Their excellent support will guide you through every step of the process, providing recommendations and elaborating on points of confusion.

By the end of the sales process, not only will you have a tailor-made hosting solution, you will also have a much better understanding of compliant IT infrastructures.

This is where OnRamp’s true value comes to light.

While it is hard to generalize on price due to the uniqueness of every solution, OnRamp services don’t come cheap.

You won’t find $99/month HIPAA hosting here.

In my consultation with OnRamp, I was quoted a monthly price of $1,464 for the following setup:

• Managed Dedicated Servers with Private Cloud
• Quad core CPU
• 16 GB RAM
• VMWare vSphere virtualization
• High availability Cisco ASA context firewall
• 500 GB SSD with built-in at-rest encryption
• 10 Mbps bandwidth (burstable to 1000 Mbps)
• Managed security services (with audits, log monitoring, etc.)
• Full7Layer Support
• HIPAA Risk Management Tool
• All other best-practices compliance measures

This falls comfortably in the mid-range for the quoted specifications.

While not a price-leader by a large margin, the value is nevertheless phenomenal. The granularity of OnRamp’s services ensures that you won’t be paying for things you don’t need, easily shaving a few hundred dollars off of your bill.

Conclusion

While startups and smaller health organizations might overlook OnRamp on price point alone—this would be a grave mistake.

The cost of managing and maintaining a truly compliant IT environment can quickly overshadow OnRamp’s reasonable managed hosting rates. The costs of non-compliance are worse yet.

If you are covered entity in need of compliant hosting, OnRamp’s fees are a small price to pay for peace of mind (and all the support you could possibly need). OnRamp offers one of the most complete and encompassing HIPAA compliant hosting services available, and it does so at a very reasonable price.

Blog posts by OnRamp:

“Warning: HIPAA Audits Set to Increase in 2017“, Blog post by Chad Kissinger, founder of OnRamp

Full disclosure: This is a paid review performed by an independent writer, according to our guidelines. Minor edits were made to this review to clarify certain findings and to correct terminology used before it was published. 

With email only increasing as the main way many patients and organizations want to do business, the advantages of using email far outweigh the risks for healthcare practices. Technology has even made HIPAA compliance for email easier and more affordable than ever.

This is a guest post written by Hoala Greevy, the Founder and CEO of Paubox.

The most obvious reason to make your organization’s email HIPAA compliant is to avoid any fines that can result from sending protected health information (PHI) in unsecure email.

When a breach happens, the cost can be astronomical both monetarily and in terms of your reputation. Companies like Sony and Anthem have shown how much damage can be done when email and data is compromised, and the threat of a breach is only increasing.

Symantec’s 2014 Internet Threat Report found breaches increased 23% over the previous year, with Healthcare being the major focus of hackers (37% of total breaches). One out of every 965 emails was a phishing attack, and hackers also make attempts to intercept your messages in transit and access information if it’s not encrypted.

However, an often overlooked reason for many breaches is not so simple to fix – human error.

In 2014, IBM’s Cyber Security Intelligence Index report found that over 95% of all incidents investigated recognized human error as a contributing factor. Even with great processes and technology, human error can’t always be solved for. Many times the employee does not even know they made an error until after a breach has occurred.

To avoid fines, some healthcare organizations don’t fully take advantage of the productivity that technology offers by still requiring patients to pick up documents or using “snail mail.” This can create a very frustrating patient experience and increase operational costs.

But there are ways to enjoy productivity gains and mitigate some of the risk for human error by having the right solutions. Making your email HIPAA compliant can greatly reduce the risk of accidentally sending (PHI) in an email. Having robust inbound phishing and SPAM filtering also lowers the risk of an employee accidentally opening an email they shouldn’t and compromising the organization.

Thankfully, there are now many HIPAA compliant email providers that can provide different levels of security for your organization. Some providers like Paubox, offer both email encryption and inbound filtering on a per user basis at an affordable cost, which is great news for small and medium-sized practices.

Secure HIPAA compliant email allows healthcare practices mitigate risks of a breach, and can help make processes more efficient and improve the patient experience without compromising PHI.