We have a scenario at my employer where we host an application that is used for uploading, storing, & managing documents related to patients' bills from healthcare providers. It is our knowledge so far that these documents contain PHI, and there are many policies developed in our Security Program to mitigate the risks of our current hosting solution.
From a pure application architecture standpoint the application is quickly expanding its used disk space, and we are trying to decide if we can leverage Cloud storage in any way. Obviously, introducing another hosting provider must be accompanied with our verification of risk mitigation on their behalf, such as in the form of a Business Associates Agreement (BAA)...
at least that is the traditional way that the "chain of custody" is maintained from any number of hosting providers.
First I'll ask: am I off base with that statement ^^?
Then I'll ask the question: is a BAA required (by law?) to host PHI such that a chain of custody exists? If not, is a BAA still applicable or even plausible for anyone looking to use Cloud provider services?
Thank you for help! Cheers! SAM