Is Your Cloud Storage Actually HIPAA Compliant? 5 Things Healthcare Organizations Get Wrong
When a healthcare organization says their cloud storage is “HIPAA compliant,” what does that actually mean? The phrase gets thrown around constantly in vendor marketing, but HIPAA compliance isn’t a certification you earn once and carry forever. It’s an ongoing operational and contractual commitment — and a surprising number of covered entities and their business associates are falling short in ways that could expose them to significant liability.
Here are five of the most common gaps we see when organizations think they’ve checked the HIPAA box.
1. A Business Associate Agreement Doesn’t Equal Compliance
Signing a BAA with your cloud vendor is necessary but nowhere near sufficient. The BAA establishes legal accountability — it doesn’t guarantee the vendor’s systems are actually configured to protect PHI. Many organizations treat the signed BAA as the finish line when it’s really the starting line. You still need to verify encryption standards, access controls, audit logging, and breach notification procedures are all in place and functioning.
Before trusting a vendor with PHI, review their security architecture documentation, ask about their last third-party security audit, and confirm their SOC 2 Type II status. A BAA without this due diligence is legal paperwork over a potential gap.
2. Default Sharing Settings Create Phantom Vulnerabilities
Most cloud storage platforms are designed for ease of sharing, not for compliance. Default settings often allow broad access — anyone with a link, entire organization access, or external sharing enabled by default. Healthcare teams who adopt these platforms without tightening configurations are inadvertently violating the minimum necessary standard before they’ve shared a single file.
A proper HIPAA-compliant setup requires reviewing and locking down every sharing permission, disabling public links entirely, and implementing role-based access that limits who can even see that a folder containing PHI exists.
3. Encryption At Rest Isn’t the Whole Picture
Vendors love to advertise “256-bit AES encryption.” What often goes unmentioned is who holds the encryption keys. If the vendor controls the keys, they — and potentially their staff, law enforcement with a subpoena, or a hacker who compromises the vendor’s infrastructure — can access your data. True HIPAA-grade protection means either customer-managed encryption keys or an architecture where the vendor genuinely cannot read the data they store for you.
Equally important: encryption in transit. Data moving between users and the cloud must be encrypted via TLS 1.2 or higher. Older protocols are not acceptable for PHI.
4. Audit Logs Are Ignored Until It’s Too Late
HIPAA’s Security Rule requires covered entities to implement hardware, software, and procedural mechanisms that record and examine access and other activity in systems that contain or use PHI. In plain English: you need audit logs, and someone needs to actually review them.
The problem is that most organizations enable logging, then never build a process to monitor it. A breach may go undetected for months — not because the logs didn’t capture it, but because nobody was watching. HIPAA requires both the capability and the practice. An annual audit log review is not enough; many compliance frameworks expect continuous or at minimum monthly review.
5. Mobile Devices Are the Forgotten Entry Point
Your server infrastructure can be locked down perfectly while a physician’s personal iPhone has unfettered access to patient records through a mobile app with no PIN requirement, no remote wipe capability, and no MDM enrollment. Mobile device management is a non-negotiable part of a comprehensive HIPAA program, yet it’s consistently underimplemented.
Every device — personal or organization-owned — that accesses PHI needs to be covered by your mobile device policy, enrolled in an MDM solution, and subject to the same access controls as your desktop environment.
Getting It Right
HIPAA compliance in the cloud isn’t about finding a vendor who claims to be compliant and handing over your data. It requires due diligence on vendor architecture, internal policy enforcement, staff training, and ongoing monitoring. The organizations that get it right treat compliance as a living process, not a one-time checkbox.
If you’re evaluating cloud storage options for a healthcare environment, start with the BAA but don’t stop there. The right platform will make it easy to meet your obligations — not just sign paperwork about them.