Last modified: February 16, 2021
Looker Data Sciences Inc. (Looker) supports Health Insurance Portability and Accountability Act (HIPAA) compliance (within the scope of a Business Associate Agreement) but ultimately customers are responsible for evaluating their own HIPAA compliance, including when using the Looker Services.
The Business Associate Agreement (BAA) covers Looker’s Services and Professional Services (if any) under a Looker-hosted deployment as described in the applicable services agreement to which the BAA is attached, except that the following are not covered by the BAA (the Excluded Services):
- Any third party Services provided by an entity other than Looker or a Looker Affiliate, including any Services provided by the third-party entities listed at the following link: https://looker.com/trust-center/privacy/google-cma-subprocessors
- Any API Integration tool that is not secure
- Any Services that are not generally available such as beta features and previews
It is your responsibility (i) to configure the Looker software and manage access to PHI using the Services in such a way that complies with the BAA (including this implementation guide) and (ii) to manage the risk of using any Excluded Services in compliance with your obligations under HIPAA.
Customer General Responsibilities
You, as the customer, are responsible for ensuring that the environment and applications that you connect to the Services and that you rely on when using the Services are properly configured and secured according to HIPAA requirements. This is often referred to as the shared security model.
Your Security Responsibilities
Essential best practices:
Recommended technical best practices when configuring the Services
- Use the “access filter” parameter in conjunction with user attributes to apply row, column, or field level data security by user or user group.
- Limit administrator, developer, and SQL runner access privileges.
- Limit support access or otherwise ensure that support teams cannot access your Instance.
- Set up any API usage between Looker and your vendor in a secure way.
- Do not share PHI via the Services or instruct Looker to share PHI via the Services (including an API), with a third-party unless a BAA is in place with the third-party.
- Manage use of the Services such that sharing PHI via email requires the recipient to click on a link within the email message, which redirects to a Looker instance in order to log into the Services for viewing the PHI/content.
- Do not allow PHI to be sent or attached via support chat.
- Configure use of the Services to reduce the amount of time query results are cached as these results may include PHI.
- Restrict the permissions for creating public links.
- Create and maintain logs when you permit a third party to use aggregated PHI.
- Implement industry-standard methods of authenticating users such as two-factor authentication or SAML-supported SSO iDP, and to the extent a user relies on SSO, restrict the “login_special_email” permission to a maximum of 2 users.
- Apply data set security within the Looker model.
- At least quarterly, perform an audit on all users, groups, permissions, roles, API keys, public links, and additional access controls, sharing, and security configuration.
Customer’s Database Security Controls
In order to use the Services, a customer must authorize the Services to access its databases. When granting authorization, each customer shall follow the principle of granting the least privilege to its database information.
When configuring database security controls, each customer will:
- ensure that all connections to the database are encrypted in transit, and if using an SSH tunnel connection, that a tunnel server is employed.
- Allowlist external access to permit only Looker specific IP addresses.
- configure the database access to ensure Looker does not have any write or administrative access to the Covered entity’s databases.