Health care facilities, health plans, and business associates are increasingly turning to cloud service providers to store, maintain, and, at times, wholly manage, the company’s electronic protected health information (ePHI).  As covered entities and business associates migrate their data to the cloud, these entities need to take a closer look at their obligations under HIPAA’s Privacy Rule and the Security Rule.