>> Welcome to our series of videos on the Azure API for FHIR.
We'll talk about interoperability,
health systems, architecture is how things FHIR.
Hi, I'm Marc Kuperstein,
Senior Director of Microsoft Health Next.
With his video, we continue
our journey of explained Azure API for FHIR.
In this video we'll talk about
security compliance as it relates to the Azure API for FHIR.
As a regulated industry,
health care demands attention to security,
data protection and compliance and failure to deliver technology
and solutions that address
these items will lead to non-acceptance.
Before we look specifically at the Azure API for FHIR,
I want to review some of the key security compliance related
challenges that affect those
of us who build software for healthcare.
It is important to understand
what our customers and clients expect.
I've put a few slides in for us to
review and there's a quite a bit of content.
If you need to pause for review,
please feel free and know I will be waiting for you patiently.
You should be somewhat familiar with
HIPAA or at least you've heard the term.
When you visit your doctor,
you're almost certainly given paperwork,
describe your rights under HIPAA and
what your provide will and will not do with
your protected health information or PHI.
HIPAA usually gives a lot of visibility,
particularly when a breach occurs.
The disclosure of PHI,
whether unintentional or not,
requires notification by the organization.
As we'll see later,
a breach can have a financial impact.
HITRUST organization is to find
a common security framework which
builds upon HIPAA and the HITECH Act,
which are US health care laws and have
established requirements for the use,
disclosure and safeguarding of
individually identifiable health information.
The CSF is divided into 19 different domains,
including endpoint protection,
mobile device security, and access control.
HITRUST certifies IT offering against these controls.
HITRUST also adapts requirements
for certification and the risks of
the organization is on
organizational system and regulatory factors.
GDPR, or the General Data Protection Regulation is
a legal framework.
This is guidelines for the collection
and processing of personal information.
Their goal, to give control to
the individuals over their personal data.
This includes the right to be forgotten.
Be aware that because this regulation protects EU citizens,
your system still have to comply.
For example, if you treat
a European citizen while he or she's on vacation in the US,
you are on the hook to be compliant with GDPR rules.
GDPR is being considered across the globe in
order to protect the user's rights
when it comes to their personal data.
In fact, the state of California has introduced
a new law called the California Consumer Privacy Act.
This came into effect in January 1st,
2020 and made strict requirements
regarding the transparency and the use of personal data.
Don't be surprised when you're asked to write
a business associate agreement or a BAA in your customers.
In short, they will understand
each party's responsibility when it comes to PHI.
The healthcare industry experiences more data breaches
and this has been confirmed through data disclosure
in any other industry in the United States.
It accounted for more than 20 percent of all breaches.
In 2017, healthcare data breaches
comprised more than five million health care records.
This chart really just talks about
the penalties and gives us a glimpse,
at least a historic view of
all the penalties that have been applied because of HIPAA.
You can see it's quite a levy on you if you fail to comply.
How do we tie this Azure API for FHIR?
We've talked about the regulations,
we talked about the requirements,
know that our Platform-as-a-Service
our managed offering is HIPAA, GDPR, HITRUST.
We've been through the oddest,
we've been to the certifications.
Assets to our solution requires authentication use OAuth2.
Access is absolutely by APIs.
There's no way to get direct access
to the underlying persistent store
and this is for your protection and protection of your users,
of your members, of your patients.
All access whether reading or writing are audited.
Who did it and what they looked at.
We, today, have customers that span providers,
payers, pharma and life sciences.
All of our security teams and lawyers who do
the review for us look at security,
data protection, and compliance.
With that, I'm going to say thank you for
your attention and we'll see you in the next video.
[MUSIC]