! # !

!"##$ &$'()*"+,- ./.

! # !
!"#$"%#&
$%& '()*&+ ,*-*&. /&01)/&2&(*. 34/ .&51/&67 2-(-8)(8 9(34/2-*)4(
,7.*&2. )( :&-6*% ;-/& -/& .1<.*-(*)-667 84=&/(&+ <7 3&+&/-6
rgulorions, spcilcolly HFAA. Th droild rquirmnrs ond
rsponsiLiliris or covrd Ly rh HFAA mniLus Rul, which wos
rvisd in 2013. niriolly, rhs rgulorions lor solguording holrh
)(34/2-*)4( ->>6)&+ >/)2-/)67 *4 %&-6*% 5-/& +&6)=&/7 >/4=)+&/. -(+
insurrs |nown os "covrd nriris".
!"#$"%#&
Thus MSFs ond vARs ol cloud Losd srvics ond producrs or olso "Lusinss ossociors" ond musr olso
ochiv HFAA complionc. Whil holrh cor dmond lor inlormorion rchnology ond spciolly scur
srorog is vosr, MSFs ond vARs musr hov o clor srrorgy ond plons lor rducing pornriol lioLiliry. A summory
ol rh HFAA Scuriry Rul con L lound or www.hhs.gov/ocr/privocy/hipoo/undrsronding/srsummory.hrml
The new HlFAA rules speciIcally deInes cloud service
providers (CSFs) as business associates.
!""" $%&'()*+ ,+%-./) &%(0.*1), (.1*+.1*1*/ 0-%+)&+)$ 2).3+2 1*4%-(.+1%* %* 5)2.34 %4
&%6)-)$ )*+1+1), .-) &%*,1$)-)$ 5',1*),, .,,%&1.+),7 -)/.-$3),, %4 82)+2)- +2)9 .&+'.339
61)8 +2) 1*4%-(.+1%* +2)9 2%3$":
Howvr, rh 2013 oddirions ro rh HFAA mniLus rul rquir rhor "Lusinss ossociors" ol rhs
"covrd nriris" musr now olso L HFAA complionr. All xisring ond nw Lusinss ossociors musr ochiv
542>6)-(5& <7 !"#$"%&"' )*'+, )-.*. Th doro covrd undr rhis rquirmnr is |nown os Frorcrd
Holrh nlormorion (FH).
This documnr provids o gnrol ovrviw ol rh Holrh
nsuronc ForroLiliry ond Accounring Acr (HFAA) complionc
rquirmnrs lor Monogd Srvic Frovidrs (MSFs) ond volu
Addd Rsllrs (vARs). r covrs som ol rh scuriry guid!
lins, lgislorion, procdurs, ond woys rhor your Lusinss con
ochiv complionc.
()*++
! ? !
/01"'"+ 23$4$4"5 6/758
T|e HFAA Frivacy Fule relers ro r|ree specilc _roups as covered enriries, includin_ |ealr| plans, |ealr|care
clearin_|ouses, and |ealr| care providers r|ar rransmir |ealr| inlormarion elecrronically.
9:543"55 7550;4<$" 69758
A person or or_anizarion r|ar conducrs |usiness wir| r|e covered enriry r|ar involves r|e use or disclosure ol
individually idenrila|le |ealr| inlormarion.
2=";$'034; >"+4;<= ?";0'+5 62>?58
Di_iral versions ol r|e paper c|arrs in a clinician's ollce. An EMF conrains r|e medical and rrearmenr |isrory ol
r|e parienrs in one pracrice.
2=";$'034; @"<=$A ?";0'+5 62@?58
EHFs locus on r|e roral |ealr| ol r|e parienr_oin_ |eyond srandard clinical dara collecred in r|e provider's
ollce and inclusive ol a |roader view on a parienr's care. EHFs are desi_ned ro reac| our |eyond r|e |ealr|
or_anizarion r|ar ori_inally collecrs and compiles r|e inlormarion. T|ey are |uilr ro s|are inlormarion wir|
or|er |ealr| care providers, suc| as la|orarories and specialisrs, so r|ey conrain inlormarion lrom all r|e
clinicians involved in r|e parienr's care.
>"+4;<= B'<;$4;" ><3<C"%"3$ !0D$E<'" 6B>!8
A care_ory ol Healr|care Solrware r|ar deals wir| r|e dayroday operarions ol a medical pracrice. Suc|
solrware lrequenrly allows users ro caprure parienr demo_rap|ics, sc|edule appoinrmenrs, mainrain lisrs ol
insurance payers, perlorm |illin_ rasks, and _enerare reporrs.
!:&;03$'<;$0'
A person or or_anizarion ro w|om a |usiness associare dele_ares a luncrion, acriviry, or service, or|er r|an in
r|e capaciry ol a mem|er ol r|e worklorce ol suc| |usiness associare.
lmportant Terms
lmportant Terms
! @ !
Any inlormorion oLour holrh srorus, provision ol holrh cor, or poymnr lor holrh cor rhor con L lin|d ro
o spcilc individuol. This is inrrprrd rorhr Lroodly ond includs ony porr ol o porinr's mdicol rcord or
poymnr hisrory.
!"#$%
&"'$%
Geograpbic Identiers
()*+", ($*./+'0 !.#1$/%
HeaItb Insurance eneciary
!.#1$/%
2"*$ !.#1$/%
34)5$ !.#1$/%
6#"+, 788/$%%$%
9$8+*", :$*)/8 !.#1$/%
7**).5' !.#1$/%
Certicate / License Numbers
VebicIe Indentiers & 5eriaI Numbers
Device Identiers & 5eriaI Numbers
Web Uniform Pesource Locators (UPLs)
Internet ProtocoI (IP) Address Numbers
iometric Identiers
;5+<.$ !.#1$/%= >4"/"*'$/+%'+*%= )/
>)8$%
2.,,?"*$ 34)')@/"A4+* B#"@$%
DeIning eFHl
Electronic Frotected Health lnIormation (eFHl)
Under HlFAA, FHl that is linked based on the Iollowing list oI 18
identiIers must be treated with special care:
! A ! ! B !
HlFAA Omnibus Rule
Businss ossociors now includ ony ol rh lollowing ryps ol nriris:
C A holrh inlormorion orgonizorion, -prscriLing gorwoy, or ony orhr nriry rhor provids doro
rronsmission srvics ro o covrd nriry ond rquirs occss on o rourin Losis ro FH.
C An nriry rhor ollrs o prsonol holrh rcord on Lholl ol o covrd nriry. Howvr, il rh prsonol
%&-6*% /&54/+ ). (4* 433&/&+ 4( <&%-63 43 - 54=&/&+ &(*)*7D *%&( *%& >&/.4(-6 %&-6*% /&54/+ =&(+4/ ). (4* -
Lusinss ossocior.
C A suLconrrocror ol o covrd nriry os wll os ony suLconrrocror ol o Lusinss ossocior, il rh
suLconrrocror occsss FH ol rh covrd nriry.
C An individuol who crors, rcivs, moinroins, or rronsmirs FH on Lholl ol o covrd nriry.
This rul chong olso includs suLconrrocrors ol Lusinss ossociors ond rquirs rh Covrd Enriry's (CE's)
Businss Associors ro nrr inro Businss Associor Agrmnrs (BAA's) wirh rhir own suLconrrocrors who
will rciv, cror, or rronsmir FH on rhir Lholl.
HlTECH Act
Covrd nriris or lioLl undr rh lnol rul lor violorions rsulring lrom rh ocrs or omissions ol o Lusinss
ossocior il rhor Lusinss ossocior is on ognr ol rh covrd nriry ond rh Lusinss ossocior is ocring wirhin
rh scop ol rh ogncy orrongmnr. l rh Lusinss ossocior is nor ocring wirhin rh scop ol rhor ogncy
orrongmnr, rh Lusinss ossocior is rhrlor lioLl.
A Lusinss ossocior is lioLl lor violorions rsulring lrom rh ocrs or omissions ol o suLconrrocror il rhor
suLconrrocror is on ognr ol rh Lusinss ossocior ond rh suLconrrocror is ocring wirhin rh scop ol rhor
ogncy orrongmnr. Businss ossociors musr comply wirh rh lnol rul Lginning !"#$"%&"' )*, )-.*.
Howvr, rhr is o spciol on-yor rronsirion priod lor implmnring Lusinss ossocior ogrmnrs
rhor comply wirh rh lnol rul. Civil pnolris lor willlul nglcr or incrosd undr rh HTECH Acr. Ths
pnolris con xrnd up ro $2S0,000, wirh rpor/uncorrcrd violorions xrnding up ro F.GH %4==403.
Legislation
SaIe Harbor Frovision
MSFs ond vARs or oLsolvd lrom ris| du ro ony doro Lroch il rh holrh doro hondld is odquorly
ncryprd. Th ncryprion procsss rsrd ond opprovd Ly rh Norionol nsrirur ol Srondords ond
Tchnology (NST) moy L lound hr: www.hhs.gov/ocr/privocy/hipoo/odminisrroriv/Lrochnorilcorionrul/
Lrguidonc.hrml
! A !
Undr HFAA, oll covrd nriris ond Lusinss ossociors
21.* .&51/& %&-6*% )(34/2-*)4( +-*- 1(+&/ - >/&.5/)<&+
conrrols lromwor| rhor provids odquor solguords lor
physicol lociliris, odminisrroriv rquirmnrs (.g. odquor
scuriry policis), ond rchnicol inlrosrrucrur.
Whil holrh cor dmond lor inlormorion rchnology ond
spciolly scur srorog is vosr, MSFs ond vARs musr hov o
clor srrorgy ond plons lor rducing pornriol lioLiliry. Srps
rhor nd ro L ro|n includ:
SaIeguards
HlFAA SaIeguards
l MSFs or hondling or hov occss ro unncryprd FH rhy musr olso conducr o scuriry ris| onolysis
procss ro includ rh lollowing ocriviris:
C Ensuring rh conldnrioliry, inrgriry, ond ovoiloLiliry ol oll lcrronic FH (FH) rhy cror,
/&5&)=&D 2-)(*-)( 4/ */-(.2)*
C 9+&(*)37)(8 -(+ >/4*&5*)(8 -8-)(.* /&-.4(-<67 -(*)5)>-*&+ *%/&-*. *4 *%& .&51/)*7 4/ )(*&8/)*7
43 *%& )(34/2-*)4(
C Frorcring ogoinsr rosonoLly onricipord, imprmissiLl uss or disclosurs
C Ensuring complionc Ly inrrnol wor|lorc ond suL-conrrocrors
Th lollowing scrions provid o ?45I 755"55%"3$ 81)+&6)(& 43 *%& -+2)().*/-*)=&D >%7.)5-6D -(+ *&5%()5-6
solguord rquirmnrs ndd ro L mr ro prorcr MSFs, vARs, lrom lioLiliry. Us rh chc|lisr ro s il
your orgonizorion is ro|ing rh ncssory srps ro mr rh complionc srondords.
C Evoluoring rh li|lihood ond impocr ol pornriol ris|s ro FH
C mplmnring opproprior scuriry mosurs ro oddrss rh ris|s idnrild in rh ris| onolysis
C E4512&(*)(8 *%& 5%4.&( .&51/)*7 2&-.1/&. -(+ *%& /-*)4(-6& 34/ -+4>*)(8 *%4.& 2&-.1/&.
C F-)(*-)()(8 54(*)(141.D /&-.4(-<6&D -(+ ->>/4>/)-*& .&51/)*7 >/4*&5*)4(.
This ris| onolysis should L on ongoing procss whr ir rviws irs rcords ro rroc| occss ro FH ond drcr
.&51/)*7 )(5)+&(*.D >&/)4+)5-667 &=-61-*&. *%& &33&5*)=&(&.. 43 .&51/)*7 2&-.1/&. >1* )( >6-5&D -(+ /&816-/67
rvoluors pornriol ris|s ro FH.
! G ! ! H !
$3CB 75",0%+%D Frlorm ond documnr on onolysis ro s whr FH is Ling usd ond
srord, ond drrmin oll possiLl woys HFAA could L violord.
$3CB 9"5"@$#$5'D mplmnr mosurs sullcinr ro rduc rhs ris|s ro on opproprior
lvl.
("5*'+)5 3),+*0D mplmnr soncrion policis lor mploys who loil ro comply.
B5?)/#"'+)5 (0%'$#% 7*'+E+'0 :$E+$F%D Rgulorly rviw sysrm ocriviry, logs, oudir rroils,
rc.
Ofcers: Dsignor HFAA Scuriry ond Frivocy llcrs.
6#A,)0$$ 3/)*$8./$%D mplmnr procdurs ro ourhoriz ond suprvis mploys who
wor| wirh FH, ond lor gronring ond rmoving FH occss ro mploys.
usiness Associate & 5ub-Contractor Agreements: Hov spciol conrrocrs wirh Lusinss
porrnrs who will hov occss ro FH ro nsur rhor rhy will L complionr.
G/@"5+H"'+)5%D Ensur rhor FH is nor occssd Ly pornr or porrnr orgonizorions or
suLconrrocrors rhor or nor ourhorizd lor occss.
Administrative
Adminisrroriv ocrions, ond policis ond procdurs, ro monog rh slcrion, dvlopmnr, implmnrorion,
-(+ 2-)(*&(-(5& 43 .&51/)*7 2&-.1/&. *4 >/4*&5* &6&5*/4()5 >/4*&5*&+ %&-6*% )(34/2-*)4( -(+ *4 2-(-8& *%&
conducr ol rh covrd nriry's wor|lorc in rlorion ro rh prorcrion ol rhor inlormorion.
Administrative
! G !
Administrative
$3CB 7**$%%D mplmnr procdurs lor gronring occss ro FH ond which documnr
occss ro FH or ro srvics ond sysrms which gronr occss ro FH.
($*./+'0 :$#+58$/%D Friodicolly snd updors ond rmindrs ol scuriry ond privocy
policis ro mploys.
3/)'$*'+)5 "@"+5%' 9",F"/$D :-=& >/45&+1/&. 34/ 81-/+)(8 -8-)(.*D +&*&5*)(8D -(+
rporring molicious solrwor.
3"%%F)/8 9"5"@$#$5'D I(.1/& *%&/& -/& >/45&+1/&. 34/ 5/&-*)(8D 5%-(8)(8D -(+
prorcring posswords.
Login Monitoring: 9(.*)*1*& 24()*4/)(8 43 648)(. *4 .7.*&2. -(+ /&>4/*)(8 43
discrponcis.
:$A)/'+5@D dnrily, documnr, ond rspond ro scuriry incidnrs.
>)5'+5@$5*0 3,"5%D Ensur rhr or occssiLl Loc|ups ol FH ond rhor rhr or
procdurs lor rsror ony losr doro.
>)5'+5@$5*0 3,"5 ;A8"'$% "58 75",0%+%D :-=& >/45&+1/&. 34/ >&/)4+)5 *&.*)(8 -(+
rvision ol conringncy plons. Assss rh rloriv criricoliry ol spcilc opplicorions ond
doro in supporr ol orhr conringncy plon componnrs.
6#$/@$5*0 9)8$D I.*-<6).% >/45&+1/&. *4 &(-<6& 54(*)(1-*)4( 43 5/)*)5-6 <1.)(&..
procsss lor prorcrion ol rh scuriry ol lcrronic prorcrd holrh inlormorion whil
oproring in mrgncy mod.
! J ! ! K !
>)5'+5@$5*0 GA$/"'+)5%D EsroLlish procdurs rhor ollow lociliry occss in supporr
43 /&.*4/-*)4( 43 64.* +-*- 1(+&/ *%& +).-.*&/ /&54=&/7 >6-( -(+ &2&/8&(57 24+&
oprorions plon in rh vnr ol on mrgncy.
9"+5'$5"5*$ :$*)/8%D 92>6&2&(* >46)5)&. -(+ >/45&+1/&. *4 +4512&(* /&>-)/. -(+
modilcorions ro rh physicol componnrs ol o lociliry which or rlord ro scuriry.
2"*+,+'0 ($*./+'0D 92>6&2&(* >46)5)&. -(+ >/45&+1/&. *4 .-3&81-/+ *%& 3-5)6)*7 -(+ *%&
quipmnr rhrin lrom unourhorizd physicol occss, rompring, ond rhlr.
7**$%% >)5'/),D mplmnr procdurs ro conrrol ond volidor o prson's occss ro
3-5)6)*)&. <-.&+ 4( *%&)/ /46& 4/ 31(5*)4(D )(561+)(8 =).)*4/ 54(*/46D -(+ 54(*/46 43 -55&.. *4
solrwor progroms lor rsring ond rvision.
I)/J%'"'+)5%D mplmnr policis govrning whor solrwor con/musr L run ond how ir
should L conlgurd on sysrms rhor provid occss FH. Solguord oll wor|srorions
providing occss ro FH ond rsrricr occss ro ourhorizd usrs.
9$8+" 9)E$#$5'D Rcord movmnrs ol hordwor ond mdio ossociord wirh FH
srorog. Cror rrrivoLl, xocr copis ol lcrronic prorcrd holrh inlormorion,
whn ndd, Llor movmnr ol quipmnr.
Devices and Media DisposaI and Pe-use: Cror procdurs lor rh scur lnol
disposol ol mdio rhor conroin FH ond lor rh rus ol dvics ond mdio rhor could
hov Ln usd lor FH.
Fhysical
Fhysicol mosurs, policis, ond procdurs ro prorcr o covrd nriry's lcrronic inlormorion
sysrms ond rlord Luildings ond quipmnr, lrom norurol ond nvironmnrol hozords, ond unourhorizd
inrrusion.
Fhysical
! J !
Unique User Identication: Assign o uniqu nom ond/or numLr lor idnrilying ond
rroc|ing usr idnriry.
7.'4$5'+*"'+)5D 92>6&2&(* >/45&+1/&. *4 =&/)37 *%-* - >&/.4( 4/ &(*)*7 .&&L)(8 -55&.. *4
lcrronic prorcrd holrh inlormorion is rh on cloimd.
Automatic Logoff: 92>6&2&(* &6&5*/4()5 >/45&+1/&. *%-* *&/2)(-*& -( &6&5*/4()5 .&..)4(
olrr o prdrrmind rim ol inocriviry.
65*/0A'+)5 "58 &$*/0A'+)5D 92>6&2&(* - 2&5%-().2 *4 &(5/7>* -(+ +&5/7>* &6&5*/4()5
prorcrd holrh inlormorion whn dmd opproprior.
6#$/@$5*0 7**$%%D I.*-<6).% >/45&+1/&. 34/ 4<*-)()(8 (&5&..-/7 &6&5*/4()5 >/4*&5*&+
holrh inlormorion during on mrgncy.
7.8+' >)5'/),%D mplmnr hordwor, solrwor, ond/or procdurol mchonisms rhor rcord
ond xomin ocriviry in inlormorion sysrms rhor conroin or us lcrronic prorcrd holrh
inlormorion.
K/"5%#+%%+)5 ($*./+'0D 92>6&2&(* *&5%()5-6 .&51/)*7 2&-.1/&. *4 81-/+ -8-)(.*
unourhorizd occss ro lcrronic prorcrd holrh inlormorion rhor is rronsmirrd ovr on
lcrronic communicorions nrwor|.
$3CB B5'$@/+'0D mplmnr policis ond procdurs ro Frorcr lcrronic prorcrd holrh
inlormorion lrom impropr olrrorion or dsrrucrion.
Technical
$%& *&5%(46487 -(+ *%& >46)57 -(+ >/45&+1/&. 34/ )*. 1.& *%-* >/4*&5* &6&5*/4()5 >/4*&5*&+ %&-6*% )(34/2-!
rion ond conrrol occss ro ir.
Technical
! ## !
Achieving Compliance With Datto
E4 741 >&/34/2 31(5*)4(. 4( <&%-63 43 - ;4=&/&+ I(*)*7 *%-* )(=46=& *%& -55&.. 4/ 2-)(*&(-(5& 43 &6&5*/4()5
prorcrd holrh inlormorion (FH)? l so, rhor mo|s you o Businss Associor. Dorro hos rroind indus!
rry-loding scuriry xprrs ond is commirrd ro ossisring our Businss Associor porrnrs wirh rhir HFAA
complionc nds.
Steps to Compliance
C Moinroining Fhysicol, Adminisrroriv ond Tchnicol Solguords ovr FH.
C Businss Associor Agrmnrs (BAAs). Dorro will sign your BAA.
C Encryprion. Srrong ncryprion is rh Lsr dlns lor |ping doro sol.
o Dorro SRS ond Dorro SRS Lir will Lorh hov on-sir ncryprion ovoiloLl in orly
croLr 2013.
o AES-2S ncryprion will |p your clinrs' doro sol on rh dvic, in lighr, ond or our
complionr doro cnrrs. Locol ncryprion nsurs doro inrgriry ond scuriry rhrough
provn mrhods ol ncryprion rgulorion |y.
o Will com wirh pr ognr or pr dvic |y conrrol, possphros Losd.
Scur Doro Cnrrs. Dorro's Li-coosrol U.S. doro cnrrs or scurd ond mr SSAE1
srondords.
Thr is no mogic Lullr. Bur il you or o porrnr rhor moinroins or occsss FH on Lholl ol Covrd
Enriris, Dorro is hr ro hlp d-mysrily HFAA complionc ond hlp you novigor rh porh ro ochiving rh
propr physicol, odminisrroriv ond rchnicol solguords you nd ro lor you ond your clinrs ro rsr ossurd.
J45;=<4%"'
Th inlormorion in rhis Loo| is lor inlormorionol purposs only, ond should nor L usd os lgol odvic. Nirhr Dorro nor irs
conrriLurors sholl L hld lioLl lor ony impropr or incorrcr us ol rh inlormorion dscriLd ond/or conroind hrin ond ossums
no rsponsiLiliry lor onyon's us ol rh inlormorion.

@ 2013, Dorro nc. All Righrs Rsrvd.
Achieving Compliance
Dorro nc. is on oword-winning vndor ol Loc|up, disosrr rcovry (BDR) ond nrllignr Businss Conrinuiry (BC) solurions, providing
Lsr-in-closs rchnology ond supporr ro irs S,000- chonnl Forrnrs rhroughour Norrh Amrico ond Europ. Dorro is rh only
hyLrid-cloud BDR/BC vndor rhor provids insronr on- ond oll-sir virruolizorion, ond scrnshor Loc|up vrilcorion, srving rh
nds ol smoll ro mdium-sizd Lusinsss.
About Datto
!"##$ &'()
101 Merritt 7
Norwalk, CT 0851
www.dattobackup.com
sales@dattobackup.com
USA: 888.24.312
Canada: 877.811.0577
UK: (01224) 451475
K3$"==4C"3$ 9:543"55 /03$43:4$L