For HIPAA, Does US Patient Data Have To Stay On US Servers?
<p>For an application that stores US patient data, does HIPAA require that US data stays on US servers?</p>

<p>No. This is governed by the <a href="https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html" rel="nofollow noreferrer">HIPAA Security Rule</a> which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt.</p>

<p>The <a href="https://www.hhs.gov/sites/default/files/june-2017-ocr-cyber-newsletter.pdf" rel="nofollow noreferrer">Rule does require</a> someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S. health care provider subject to HIPAA would have a foreign server), but the Rule does not require that a server be physically located in the United States.</p>

<p>The lack of this requirement is a good one, because when you are transmitting data (which the Security Rule requires be done in a secure fashion), you can't know which servers the information will end up on in a trip from source to destination. Email and all other Internet content travels through what amounts to a pony express. It goes through a variety in intermediate server nodes which can change during the course of a session, and generally speaking, you never know which intermediate nodes are used. You could be seeing this answer via a server in China, for example, and you would never know it.</p>

international data-ownership data-protection data-storage hipaa