Bill Barnett, Bob Flynn & Anurag Shankar Pervasive Technology Institute and University Information Technology Services, Indiana University CASC. September 17, 2014 Bringing Box into HIPAA Alignment

CASC. September 17, 2014 University Information Technology Services Outline 1.Introduction 2.Service Partnership 3.Box Evaluation 4.Conclusions

CASC. September 17, 2014 University Information Technology Services 1. Introduction

CASC. September 17, 2014 University Information Technology Services Nature abhors a vacuum Because of the lack of HIPAA aligned campus services that support external collaborations, biomedical researchers share sensitive data using and cloud services such as Google docs, Dropbox, etc.

CASC. September 17, 2014 University Information Technology Services The lure of cheap, ubiquitous cloud storage is irresistible. Cloud providers have been unaware or unwilling to address HIPAA compliance. Market pressures are forcing some vendors, including Amazon, Microsoft, and Box, to reconsider. We at IU have also been revisiting our stance of requiring our sensitive data to be kept on site. HIPAA in the Cloud?

CASC. September 17, 2014 University Information Technology Services 2. Service Partnership

CASC. September 17, 2014 University Information Technology Services Implemented at IU in 2012, Box has become popular for sharing data with collaborators within and outside IU. Researchers in the IU School of Medicine (second largest medical school in the U.S.) want to use Box to share clinical research data. This requires that Box be HIPAA aligned. & HIPAA

CASC. September 17, 2014 University Information Technology Services In 2013, Box began talking about the possibility of HIPAA alignment after conducting thirty party security and HIPAA audits. In late 2013, they began signing contracts promising to comply with HIPAA. Internet2 has negotiated a BAA* and revised contract with Box. Box & HIPAA * = Business Associate Agreement

CASC. September 17, 2014 University Information Technology Services Basics Program rollout April 2012 Reached 50,000 users by October 2013 Currently 74,000 internal users 9,000 external collaborators 180,000 collaborations 68TB in storage All this without FERPA or HIPAA data

CASC. September 17, 2014 University Information Technology Services Growth

CASC. September 17, 2014 University Information Technology Services 3. Box Evaluation

CASC. September 17, 2014 University Information Technology Services While Box told us they were HIPAA ‘compliant’, due diligence (to us) meant evaluating whether Box met the same NIST standards we follow ourselves.

CASC. September 17, 2014 University Information Technology Services The Stack Network Box Cloud Environment OS Application Authentication Box Box/IU Layer Responsible User Interface Box

CASC. September 17, 2014 University Information Technology Services What we Did We asked Box for documentation of their information security practices, audit reports, etc. We reviewed the documents thoroughly. We used the NIST HIPAA Security Rule Toolkit to answer nearly 1000 questions about Box’s security/risk management practices. Some of these answers came from the Box documentation, some from Box’s Compliance folks.

CASC. September 17, 2014 University Information Technology Services NIST HIPAA Security Rule Toolkit Questionnaire

CASC. September 17, 2014 University Information Technology Services Evaluation Results Box answered > 95% of the questions satisfactorily. They have the necessary “Required” and “Addressable” HIPAA safeguards in place. It helps greatly that they encrypt all data both during transit and at rest for enterprise customers and secure the encryption keys.

CASC. September 17, 2014 University Information Technology Services Current Status We have a signed BAA with Box. We are HIPAA aligning IU authentication services (Shibboleth and CAS) for ePHI, with a final check by internal governance (Security, Audit, Compliance). After the above are completed, we will issue an ATO and make Box available to biomedical researchers as a HIPAA aligned collaboration tool.

CASC. September 17, 2014 University Information Technology Services 4. Conclusions

CASC. September 17, 2014 University Information Technology Services Conclusions Box provides an ideal data sharing environment for researchers, biomedical or otherwise. Our own NIST-based evaluation found Box to be capable of keeping our ePHI secure. We are using our existing standards to satisfy dependencies and ensure end to end security.

CASC. September 17, 2014 University Information Technology Services Contact Bill Barnett Bob Flynn Anurag Shankar

License Terms Please cite as: Barnett, W., R. Flynn and A. Shankar, Bringing Box into HIPAA Alignment, presented at the Fall 2014 Coalition for Advanced Scientific Computing meeting, Arlington, DC. Items indicated with a © are under copyright and used here with permission. Such items may not be reused without permission from the holder of copyright except where license terms noted on a slide permit reuse. Except where otherwise noted, contents of this presentation are copyright 2011 by the Trustees of Indiana University. This document is released under the Creative Commons Attribution 3.0 Unported license ( This license includes the following terms: You are free to share – to copy, distribute and transmit the work and to remix – to adapt the work under the following conditions: attribution – you must attribute the work in the manner specified by the author or licensor (but not in any way that suggests that they endorse you or your use of the work). For any reuse or distribution, you must make clear to others the license terms of this work.