Cybersecurity and disaster recovery

We recognize that HIPAA compliance begins with organizational policies, procedures, and practices reinforced through appropriately secured technology. OCHIN is fully compliant with HIPAA and HITECH. As the health care landscape continues to evolve, we undergo regular compliance reviews designed to reinforce existing tools and identify potential updates for the future.

Our disaster recovery policies and procedures are fully compliant with HIPAA and industry standards. To further minimize the potential for data loss in case of a natural disaster, we use a secondary data center in a different geographic region and on a separate tectonic plate from the primary data center site. Member clinics are connected to both primary and secondary datacenters through OCHIN’s privately managed medical grade network. The disaster recovery facility is activated annually, and member clinics are required to test their access to the facility.

OCHIN maintains regularly scheduled backups for each information system. Clinical information is replicated to separate systems both within the primary facility (highly available) and the secondary facility (disaster recovery) within seconds of being committed to the production systems. Additional storage area network “snapshots” and copies to separate network storage occurs nightly for long-term offline protection. All backups are stored on AES-256 encrypted devices. 

OCHIN employs a team of highly experienced and credentialed data security personnel. We consider it every employee’s responsibility to ensure that patient information is protected and that all HIPAA Privacy and Security Policies and Procedures are followed. OCHIN staff receive appropriate education and training based on position and access to protected health information and personally identifiable information.