Code42 and HIPAA compliance

Basic HIPAA compliance

• Use the standard Incydr, Code42 for Enterprise, or CrashPlan for Small Business configuration
  The only requirement to support HIPAA compliance is to have encryption enabled. Encryption is enabled by default for new customers.
  Enabling encryption (if it was previously disabled)
  Existing Code42 customers may have previously disabled encryption when that option was available in the Code42 console. If you previously disabled encryption, use the API to set encryptionEnabled to "true" to enable it for HIPAA compliance. For help, contact Code42 about engaging Code42's Professional Services team.

More stringent HIPAA compliance (Incydr and Code42 for Enterprise only)

• Option 1: Activate Compliance Settings in your Code42 console (Code42 for Enterprise only)
  • Automatically configures a number of settings at once to restrict access to backed-up files.
  • Requires Code42 server version 5.4 or later.
  • Not compatible with Incydr, Legal Hold, File Search, or user file activity monitoring features.
  Compliance Settings and HIPAA 
  Note that Compliance Settings goes beyond what Code42 requires to support compliance with HIPAA. Use these options if your Code42 environment requires more control over backup data.
  Compliance Settings are for backup-only Code42 environments
  Incydr's file activity monitoring and insider risk detection capabilities are not supported if you enable Compliance Settings.
• Option 2: Configure your settings manually to enhance access restrictions
  • Available for all Code42 server versions.
  • Compatible with Legal Hold, File Search or Forensic Search, and user file activity monitoring features, depending on the settings you select in your manual configuration.
  • If you choose to manually configure your on-premises Code42 environment, see Configure on-premises Code42 environments for use with HIPAA (Code42 server version 6.x and later). For Incydr and Code42 environments in the cloud, contact sales about engaging Code42's Professional Services team for help with manual configurations to support HIPAA.
  • Recommendations for supporting HIPAA with a manual configuration:
    • Store your encryption keys in an on-premises authority server or in an external keystore.
    • Assign user roles to prevent unauthorized restoration of data.
    • Monitor logs for changes to user roles, user creation, and user deactivation.
    • Restrict visibility of backup data to only users and administrators authorized to view ePHI.

Incydr and Code42 for Enterprise customers

Contact sales to engage Code42's Professional Services team if you have questions on how to:

• Obtain a BAA with Code42
• Manually configure your Incydr or Code42 for Enterprise deployment to support HIPAA
• Audit user or file activity with the Code42 API

CrashPlan for Small Business customers

If you would like to obtain a BAA, contact our Customer Champions. 

Interested in Code42's products?

If you are new to Code42, contact one of our sales teams to get started:

• Incydr and Code42 for Enterprise sales
• CrashPlan for Small Business sales