<![CDATA[Remote Backup Systems]]> <![CDATA[Access to RBS resources for several people in the same company]]> We sometimes get requests from employees and partners of our registered Service Providers for access to our online resources like the Member's Forum, and for technical support.

For reasons of security, (and because we just haven't programed it that way yet!) we only grant additional access to online and support resources on the authorization of the original purchaser. Further, and because of the same security concerns, we cannot discuss the products or accounts of our Service Providers with anyone except those specifically authorized by the Service Provider.

This is not to say that we always grant access, even at the request of the registered Service Provider - obviously, doing so puts an extra support burden on RBS by maintaining multiple accounts under one name.

It's handled on a case-by-case basis.

 

]]> <![CDATA[Can another company take my clients?]]> During installation you will customize your endpoint software so it can only call YOUR server, and none other. So, another RBS Provider, even if he is using the same software as you, cannot take your clients without your permission.

 

]]> <![CDATA[Can I buy RBS software from one of your service providers?]]> Question: Can I buy your software from someone else? Can I buy another Service Provider's already-registered software?

Answer: You may, of course, become a customer of any of our Service Providers who are authorized to distribute our endpoint software as part of their Remote Backup business. You may NOT buy RBS Server software from any source other than directly from RBS or from one of our resellers.

WARNING: Check with RBS before you purchase software from anyone claiming to be a Reseller or Agent of RBS. 

Except in rare cases, RBS software licenses are non transferrable. Buying RBS Software from anyone other than Remote Backup Systems invalidates any license that might exist on that software. Maintenance Subscriptions, no matter how much time is left on them, will be terminated. Support and upgrades will no longer be available. The software may stop running.

If RBS approves a license transfer, we charge a fee of 20% of the current retail price of the package plus purchase of a new maintenance subscription.

We cannot combine licenses. If an existing Service Provider buys another Service Provider's license in an approved transaction, we cannot add the license counts together on one Server. Two instances of RBS Servers cannot be run on the same computer. Two maintenance subscriptions will be required. Software upgrades must be applied separately.

If you are considering buying someone else's sofware license to save some money, please think about the following important considerations: You may be buying pirated or stolen software. Only RBS can verify the authenticity of our software and its owners.

The software may be (probably is) out of date.

The software will not be supported by RBS, and will not be upgraded.

The RBS Server Locator will not work with your system.

You will not have access to the Partner's Portal, the Forum or to any of the other valuable business and technical resources offered to licensed Remote Backup Service Providers.

If you have any questions about how all this works, please contact RBS.

 

]]> <![CDATA[Can I recycle endpoint licenses if a customer drops service?]]> Yes. Just delete that endpoint's account at your RBS Server and the licenses will be recovered for use with another customer.

RBackup's licenses are managed by your Server.

Here's an example - if you buy a 100-License version of RBackup you own those 100 licenses forever. You may distribute thousands of copies of the Client software if you like, and you will not use licenses until someone signs up for your service and you add an account for them at your Server.

]]> <![CDATA[HIPAA compliance - Is Remote Backup HIPAA compliant?]]> Please Note: This article was written for RBS Providers only, as an introduction to HIPAA from the perspective of providing RBS services. It is not designed to be used in sales materials directed toward end users, nor on your web site.

Presenting this article as-is to end users is confusing and does not help sales. You are welcome to paraphrase a couple of paragraphs only for your sales materials, but please do not copy and use any part of it verbatim. See the special copyright notice at the end of this article.

Is Remote Backup HIPAA Compliant?

The Short Answer:

RBackup complies with the Final Security Rule, but please read on. RBackup RBS Software will compress and encrypt data before sending it to the RBS Server. Remote Backup offers secure data backup software and data backup systems for online data backup.

The Encryption Key generated by RBackup is known only to the customer, and is never transmitted to the Server nor to RBS, Inc. Data are stored on the RBS Server in compressed and encrypted archives that are not accessible by the RBS Service Provider.

RBackup Remote Backup Software is adequate to help companies comply with the Final Security Rule. RBS also complies with the Privacy section, even though RBS Providers are not Covered Entities as defined by the current rules, and thus are not required to comply with it.

In addition, RBackup can help customers comply with other provisions of the rules as part of a larger data protection and disaster recovery plan. At the time of this writing there is no "HIPAA Compliance" certification for backup software, and it is important to note that under the current rules, no software is truly "HIPAA compliant," because there are no regulations that specifically address backup and privacy software.

The Long Answer:

In 1996, a bill known as the Kennedy-Kassebaum Bill was passed by the U.S. Congress and signed into law by President Bill Clinton. The new law was known as the Health Insurance Portability and Accountability Act of 1996, or more commonly, HIPAA. It had started as a measure to ensure that workers could keep their health insurance when they changed jobs. By the time of its passage, it had become much more complex and far-ranging, affecting the vast majority of all health-care entities in the United States.

Because of the complexity and wide range of HIPAA, there has been and continues to be a great deal of confusion about how it applies to many areas, including Remote Backup. This page will present a brief overview of HIPAA, and demonstrate how Remote Backup can be a valuable tool in meeting the requirements of HIPAA's Security Rule.

Who Must Comply

Those who must comply with HIPAA fall into two categories. The first category is Covered Entities. Covered Entities include all health plans, health care clearinghouses, or health care providers who transmit health information in electronic form.

The second category is the Business Associates of those Covered Entities. A Business Associate is someone who performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.

Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services.

However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information (PHI), and where any access to protected health information by such persons would be incidental, if at all.

Must Remote Backup Service Providers Comply?

Remote Backup Service Providers are clearly not Covered Entities.

Because Remote Backup Services does not involve the use or disclosure of PHI, and any access to PHI by a Remote Backup Service Provider would be incidental, if even possible, Remote Backup Service Providers are not normally considered to be Business Associates, and are therefore not covered by the HIPAA Privacy Rule. However, some Covered Entities may wish to have a Business Associate Contract in place regardless. How this is handled is up to the individual Remote Backup Service Provider.

Remote Backup Services do clearly fall within the requirements of the HIPAA Security Rule. Covered Entities must be compliant with the Security Rule by April 21, 2005. Remote Backup software and services are compliant today, and can provide a foundation for overall compliance.

HIPAA Overview

HIPAA consists of five parts:

# Title1 - Health Insurance Portability - helps workers maintain insurance coverage when they change jobs
# Title 2 - Administrative Simplification - standardizes electronic health care-related transactions, and the privacy and security of health information
# Title 3 - Medical Savings Accounts & Health Insurance Tax Deductions
# Title 4 - Enforcement of Group Health Plan provisions
# Title 5 - Revenue Offset ProvisionsFortunately, four of the five parts of HIPAA have no bearing on Remote Backup. The one part that does apply is Title 2 - Administrative Simplification.

Administrative Simplification

HIPAA Administrative Simplification consists of two areas. The first is commonly referred to as the Transactions and Code Sets Rule, although it also covers standardization of identifiers. This Rule requires standardization in all health-related electronic transactions, such as electronic transmission of insurance claims, verification of insurance, statements, explanations of benefits, remittance advice, etc. It is scheduled to take effect in October 2003.

Remote Backup is not a health-related transaction, and is therefore not covered under the Transactions and Code Sets Rule.

The second area of Administrative Simplification is made up of two Rules, the Privacy Rule and the Security Rule. Because these two rules are where the most confusion arises, we will examine them in some detail.

Privacy and Security

Before the Privacy and Security Rules can be explained, we must understand what they are intended to protect. Both Rules are intended to safeguard any health-related information that can be traced to or used to identify an individual. Some examples of this type of information include name, address, Date of Birth, Social Security number, or any other identifier. This type of information is referred to as Protected Health Information, or PHI.

The Privacy Rule and Security Rule are intended to protect PHI in different ways. The Privacy Rule sets out limits on who can have access to PHI and for what purpose. The Security Rule regulates the Procedural, Physical and Technical means that are used to protect PHI.

Privacy

The Privacy Rule places limits on the ways that PHI can be used and disclosed, and requires accounting of disclosures. But it is relevant at this point to review how Remote Backup works.

With a Remote Backup solution, all information to be backed up is encrypted by the local client before being transmitted, using a key that is stored locally. Data is stored on the remote server in its encrypted form. Data can only be recovered by transmitting it back to the local client, which decrypts it, again using the locally-stored key. The most important feature of this arrangement is that while the data is stored on the remote server, it is encrypted and not in a readable format. The remote server does not have access to the key, and without the key, the data cannot be converted to a readable format.

Remote Backup Services do not involve the use or disclosure of PHI. All back-up data is stored on the Remote Server in an encrypted form, and any access to PHI by a Remote Backup Service Provider would be incidental, if even possible. Remote Backup Service Providers are therefore not normally considered to be Business Associates, and are not covered by or required to be compliant with the HIPAA Administrative Simplification Privacy Rule.

Security

The Security Rule is the one part of HIPAA that clearly applies to the type of services that Remote Backup offers. The Final Security Rule was published in February 2003, and became effective on April 21, 2003. Compliance with this Rule will be required by April 21, 2005.

The Security Rule legislates the means that should be used to protect PHI. It requires that covered entities have appropriate Administrative Procedures, Physical Safeguards, and Technical Safeguards to protect access to PHI.

Examples of appropriate safeguards include:
# Establishment of clear Access Control policies, procedures, and technology to restrict who has authorized access to PHI.
# Establishment of restricted and locked areas where PHI is stored.
# Establishment of appropriate Data Backup, Disaster Recovery, and Emergency Mode Operation planning.
# Establishment of technical security mechanisms such as encryption to protect data that is transmitted via a network.Remote Backup is compliant with the Final Security Rule.

The Remote Backup client software contains all appropriate technical security mechanisms to protect the data that is transmitted to and from the Remote Backup Server.

Remote Backup can form a critical part of Data Backup, Disaster Recovery, and Emergency Mode Operations strategies by providing offsite backup that can be geographically distant from the client site to minimize the likelihood of data loss in a large-scale disaster. In the event of loss of the primary data center, data on a Remote Backup Server can easily be recovered from any replacement data center.

Covered entities will be required to comply with the HIPAA Administrative Simplification Security Rule by April 21, 2005. Remote Backup, as part of a comprehensive security plan, can be an important part of compliance strategy.

Disclaimer Please note that, although all information presented on this page is believed to be factually correct, this page is not intended to give legal advice. Please consult with your legal counsel if you have questions about your specific situation.

Copyright (c) Remote Backup systems, Inc. All Rights Reserved. This web page and all others on our web sites are the sole property of Remote Backup Systems, Inc. You may not copy or distribute or republish any content on this page or any other page on our web sites without specific written consent of Remote Backup Systems, Inc. (except as mentioned in the second paragraph of this page) The copyright release form in the RBS Business Kit gives you rights to reproduce certain parts of the RBS Business Kit, but does not cover any part of any RBS web site. Protected content includes text, graphics, movies, meta tags, Javascript, "look and feel" methods of navigation, screen shots, product names and other Trademarks and Service Marks.

 

]]> <![CDATA[How do I charge, and how much?]]> That's one of the most frequent questions around here. SO, we wrote a page about it. Here's a link to it:

http://remote-backup.com/settingprices.htm

 

]]> <![CDATA[How do I compete with really cheap backup services?]]>  

http://blog.remote-backup.com/how-can-i-compete-with-5-a-month-online-backup-services/

 

]]> <![CDATA[How much money can I make, and what are my costs?]]>
This question is common, and we have many articles about it, and some calculators. We recommend picking an article from our Blog at http://blog.remote-backup.com or using the website's Search feature.

 

]]> <![CDATA[Liability, Security, and Contract issues]]> There isn't as much liability for a Remote Backup Service Provider as you might think. We are in contact with most of the RBS providers around the world, and not one of them has ever been sued over RBS-related issues to date, in the history of the company.

Clients used to be nervous about sending their data to a remote computer over the Internet, but this is not common these days. RBackup handles this problem by encrypting the data.

Before leaving the client's computer, the backup data are encrypted, sometimes using several different techniques, with a password that only the client knows. This makes the data unreadable to anyone who doesn't know the passwords - including the RBS provider.

This technique is quite secure, and makes certain that no one but the client can use his data.


WHAT IF I LOSE A CLIENT'S BACKUP?

This is a problem that is best handled contractually. The Partner's Portal contains downloadable samples of service contracts that you can modify for your own use. Your service contract should limit your liability to what the client has paid for your service.

You should agree only to make your service available for the client to use for backing up his computers, take reasonable steps to maintain your service, and take reasonable steps to prevent any possible loss of data. Most of these "reasonable steps" are handled automatically by the RBS software.

Think of your Remote Backup Service as a communications service like the telephone company. Can you imagine suing the phone company because a line went down and you lost some data? How about suing the power company because the lights went out and you lost a freezer full of food? 

The sample contracts are real contracts that have been used successfully by Remote Backup Services all over North America. They address all of these issues. You can customize them and have them approved by an attorney.

There are insurance companies that provide affordable insurance to help protect you. Search online for them.

 

]]> <![CDATA[Is there a report that shows only the size of the first full back...]]> Question: I want to bill my customers for the size of only the first full backup, and not subsequent backups. Is there a report that will do this?

Answer:

We do not have a report that gives only the size of a single full backup on an ongoing basis. I don't know anyone who charges like that, so we didn't consider it a reporting option.

You have 2 ways to do this, neither of them automated.

1. Pull a Disk Resources report just after the first full backup and before any subsequent backups. This will tell you the size of the first full backup but will not take into account every new file added thereafter, nor a growth in the size of any of the files - especially databases like Exchange or SQL Server.

2. Use our free Estimator utility (link below) to estimate a full backup. This would be more accurate but would require running the utility periodicially and making sure its file selection rules are identical do those used in your RBS Client software.

estimator: http://www.remote-backup.com/online-backup-estimator/

Neither of these is perfect, but its the only way to do what you want with the current version of our software. If this method of billing becomes a popular option then of course we will add it.


]]>