About OneTrust HIPAA Hosting Option
OneTrust offers a hosting option for U.S. companies that need OneTrust to host Protected Health Information (PHI), as it is defined under the Health Insurance Portability and Accountability Act (HIPAA). OneTrust's HIPAA hosting environment is set up to be subject to OneTrust's HIPAA program. This means that OneTrust employees are trained in the policies, and the program is designed to address the administrative, physical, and technical safeguards of the security rule. OneTrust will agree to sign a business associate agreement (BAA) when the HIPAA hosting environment is selected, which is an important requirement for companies that need OneTrust to host PHI.
For more information, see the HIPAA resources available in our Research Portal.
HIPAA Hosting FAQ
The following responses are supported solutions to frequently asked questions (FAQ) about the OneTrust HIPAA hosting option. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.
What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 forms the primary federal regulation for patient privacy in the healthcare sector in the U.S. HIPAA's Privacy and Security Rules, alongside the Enforcement Rule, form a tapestry of comprehensive regulation for the sector and can make compliance a complicated issue for privacy professionals.
Who is the OneTrust HIPAA hosting option for?
U.S. companies that need to comply with HIPAA and need OneTrust to host PHI.
Can I migrate to a HIPAA environment if I'm already set up on an existing environment?
Yes - You can submit a request to migrate to a HIPAA environment by completing the OneTrust Tenant Copy Request form and selecting the Data Center Migration option. For more information, see Submitting a Tenant Copy Request.
How can I migrate to a dedicated HIPAA environment?
You can submit a request to migrate to a dedicated HIPAA environment by completing the OneTrust Tenant Copy Request form and selecting the Standard Cloud to Dedicated Cloud option. This option requires that you have a separate license agreement approved. In addition, a Dedicated Cloud instance should already be set up. For more information, see Submitting a Tenant Copy Request.
What are the differences between a HIPAA environment and a non-HIPAA environment?
The following table provides a comparison between the HIPAA environment and non-HIPAA environments:
|
HIPAA Environment |
Non-HIPAA Environment |
|
|---|---|---|
|
Hosting Location |
The designated HIPAA environment is hosted in the US region. |
OneTrust has multiple environments hosted across various regions, including an environment in the US region. For more information, see About OneTrust Hosting Options, Locations, and Backup. |
|
Infrastructure |
The infrastructure handling customer traffic is set up identically for all environments. |
|
|
Product Features |
Availability of product features is the same across all environments, with the exception of the OneTrust EU Data Residency feature which is currently available upon request for customers with accounts hosted in a OneTrust European Union environment. For more information, see About OneTrust EU Data Residency Options for Cloudflare. |
|
|
Troubleshooting Logs |
Logs from the OneTrust application are stored in the US region. |
Logs from the OneTrust application are stored in the EU region. |