FTP Today serves many firms within the medical industry that fall under HIPAA regulations. We are therefore sensitive to your HIPAA compliance issues. For example, many medical transcription companies, use FTP Today to transfer voice and text files on a daily basis.
According to the Department of Health and Human Services, FTP Today is not considered a HIPAA Business Associate:
Other Situations in Which a Business Associate Contract Is NOT Required.
* With a person or organization that acts merely as a conduit for protected health information, for example, the US Postal Service, certain private couriers, and their electronic equivalents.
See HSS website
That said, FTP Today offers multiple safeguards to our HIPAA sensitive customers, including:
- Our servers are all located in highly secure data centers, thereby making it impossible for equipment (such as a hard drive containing medical data) to be stolen. In addition, as required by HIPAA regulations, our data center isSAS 70 certified.
- No copies of your files reside on any offsite or long-term storage media. Also, our backup procedures have been carefully designed with privacy in mind.
- We do not host on the Windows operating system, as Windows servers are constantly under attack and are much more vulnerable than Linux servers. In addition, we use only enterprise grade Linux operating systems.
- FTP username and password is required. Our servers do not accept Anonymous-FTP connections, a common hacker method of seeking out an FTP site for possible attack.
- We proactively monitor and react to intrusion attempts into our systems through the use of a sophisticated Intrusion Detection System (IDS) and multiple operating system level security tools.
- Passwords are hashed in our server authentication database.
Important Note - Password creation and maintenance is your responsibility. We recommend that you make all passwords difficult to crack and follow reasonable standards for password security. Since FTP Today puts you in charge of password maintenance, this fact alone means that FTP Today is not responsible for disclosure of private informaton in the event your assigned username/password combinations are cracked by some third party.
See http://en.wikipedia.org/wiki/Password_cracking for more information on password cracking.
- We offer the use of 128-bit transfer encryption (at a minimum) via industry-standard methods.
Important Note - It is suggested that your users exclusively utilze encrypted connections. FTP Today can configure a port filtering firewall to force 100% your users to connect via an encrypted protocol (no extra charge with encrypted services).
Disclaimers:
- FTP Today is not considered a "HIPAA Business Associate" and is not itself subject to HIPAA regulations. In practical terms, we are not a Business Associate because we are nothing more than the electronic equivalent of a courier or delivery service, albeit a much safer and secure form of delivery service.
- FTP Today considers its services "HIPAA Ready," and proper use of the tools we provide should meet your needs of HIPAA compliance, however you should consult your own attorney in that regard. This information is general in nature and should not be relied upon as legal advice. We also recommend a look at http://www.hipaadvisory.com
- Any site hosted by FTP Today is subject to the terms and conditions, acceptable use and privacy policy, as posted on this website.
