Short: If the data (PHI) I send to a third party is already encrypted, do I still need to sign a Business Associate Agreement (BAA) with them to stay HIPAA compliant?

To be specific, I was considering Twilio's chat solution and they claim it is HIPAA compliant. If the messages sent are end-to-end encrypted using a FIPS 140-2 compliant cipher (if what Twilio receives & stores is already 'gibberish' and they don't have any means to decrypt them), is it HIPAA compliant?

Is signing a BAA required for handling encrypted PHI? (even if the data is encrypted before it leaves the client device?) At the moment Twilio does not sign BAA agreements.

What HIPAA says:
I found this title in HIPAA website, conflicting with what Twilio advertises about no BAA signing required:

  • If a CSP (Cloud Service Provider) stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?
    • Yes, [...] Lacking an encryption key for the encrypted data it receives and maintains does not exempt a CSP from business associate status and associated obligations under the HIPAA Rules. [...] As a business associate, a CSP providing no-view services is not exempt from any otherwise applicable requirements of the HIPAA Rules. However, the requirements of the Rules are flexible and scalable to take into account the no-view nature of the services provided by the CSP.
  • Can a CSP be considered to be a “conduit” like the postal service, and, therefore, not a business associate that must comply with the HIPAA Rules?
    • Generally, no. [...] even if the CSP cannot view the ePHI because it is encrypted and the CSP does not have the decryption key. [...] the conduit exception is limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission [...] In contrast, a CSP that maintains ePHI for the purpose of storing it will qualify as a business associate, and not a conduit, even if the CSP does not actually view the information, because the entity has more persistent access to the ePHI. [...]

What Twilio & Virgil says:

  • In their Twilio & Virgil Security: HIPAA Compliant Chat white-paper, Virgil claims, they have obtained an expert opinion that the method of encryption they use de-identifies the data in accordance with the HIPAA Privacy Rule (§164.514(b)(1) of the HIPAA privacy rule.), and as a result data is not considered as PHI while on Twilio’s platform.
  • Yes, I agree. But I don't understand how a large company like Twilio can advertise their solution as HIPAA compliant if that is the case. Also the last sentence ("rules are flexible and scalable") brings a lot of ambiguity. – Murat Ozgul Feb 21 '18 at 21:23
  • I think it is saying that other rules that apply to a CSP are scalable, but that this rule still applies – osdavison Feb 21 '18 at 21:36
  • just a thought: maybe Twilio thinks that they do actually count as a conduit IF (and this is a big if that I'm not sure about) they don't have persistent access to the ePHI, but consistently delete it as soon as it is sent along. This would be in contrast to a generic CSP which usually doesn't bother too much about how long they hold on to data (maybe forever in server logs). – NH. Feb 21 '18 at 23:51
  • @NH. They do for video chat (if you opt-out of logging & archiving the video call). But for programmable chat, they are storing the messages; client SDKs get the messages from Twilio servers with a token they get from your business logic servers. – Murat Ozgul Feb 22 '18 at 0:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.