Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant?
To be specific, I was considering Twilio's chat solution and they claim it is HIPAA compliant. If the messages sent are end-to-end encrypted using a FIPS 140-2 compliant cipher (if what Twilio receives & stores is already 'gibberish' and they don't have any means to decrypt them), is it HIPAA compliant?
Is signing a BAA required for handling encrypted PHI? (even if the data is encrypted before it leaves the client device?) At the moment Twilio does not sign BAA agreements.
What HIPAA says:
I found this title in HIPAA website, conflicting with what Twilio advertises about no BAA signing required:
- If a CSP (Cloud Service Provider) stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?
- Yes, [...] Lacking an encryption key for the encrypted data it receives and maintains does not exempt a CSP from business associate status and associated obligations under the HIPAA Rules. [...] As a business associate, a CSP providing no-view services is not exempt from any otherwise applicable requirements of the HIPAA Rules. However, the requirements of the Rules are flexible and scalable to take into account the no-view nature of the services provided by the CSP.
- Can a CSP be considered to be a “conduit” like the postal service, and, therefore, not a business associate that must comply with the HIPAA Rules?
- Generally, no. [...] even if the CSP cannot view the ePHI because it is encrypted and the CSP does not have the decryption key. [...] the conduit exception is limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission [...] In contrast, a CSP that maintains ePHI for the purpose of storing it will qualify as a business associate, and not a conduit, even if the CSP does not actually view the information, because the entity has more persistent access to the ePHI. [...]
What Twilio & Virgil says:
- In their Twilio & Virgil Security: HIPAA Compliant Chat white-paper, Virgil claims, they have obtained an expert opinion that the method of encryption they use de-identifies the data in accordance with the HIPAA Privacy Rule (§164.514(b)(1) of the HIPAA privacy rule.), and as a result data is not considered as PHI while on Twilio’s platform.