Security & Compliance
Incident response
If you suspect a security incident involving ArkCloud - a compromised account, data you should not be able to see, or a message that looks like it came from us and did not - report it straight away. This page says where, what happens next, and what is not yet in place.
Written for: Security contacts · Privacy officers · Administrators
How to report
Email [email protected]. Include what you saw, when, which user accounts and screens were involved, and how to reach you. Do not include patient information in the email - refer to records by their ArkCloud account or record number.
What you can do immediately
- Deactivate any user account you believe is compromised, and use Force logout on it.
- Ask affected users to reset their passwords. A reset also signs the user out of every existing session; Force logout comes first so that access stops before the reset is done.
- Note the time you noticed the problem and keep screenshots; do not delete anything.
- Report to ArkCloud as above.
What ArkCloud does as your business associate
| Field or control | What it means |
|---|---|
| Notification to you | If a breach of unsecured PHI is discovered, ArkCloud must notify you, the covered entity, without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410), or sooner if your Business Associate Agreement says so. |
| Service status | Outages and incidents affecting the service are posted on the public status page by ArkCloud staff. Component health is also recorded there about once a minute, but those checks do not alert anyone. |
| Notification to patients, HHS and media | Your obligation as the covered entity, unless your Business Associate Agreement delegates it to ArkCloud. |
| Evidence ArkCloud can provide | Sign-in and lockout records, the security audit log, the PHI access log (written by every screen that opens a patient's record), edge request logs and host logs. See the audit logging page for their limits. |