It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more.
I'd suggest you work with a company that has a lot of experience in this area before you inadvertently find yourself fined (or sued) into bankruptcy.
A lot of HIPAA complience also has to do with due dilegence. My organization recently when through a long period of training that covered everything from building access logs to the way we do employee password resets. Unfortunately there aren't hard, static rules that define it.
On the positive side- I've learned to love the compliance. Most of it is common sense things (like not giving out info over the phone to any random person) and has made our organization more efficient.
This exactly. It's not like there are just a few commands to run in Linux that gets you a HIPAA-compliant server. It is a pretty long and arduous process that involves several business-level requirements, in addition to the technical ones.
Comments
It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more.
I'd suggest you work with a company that has a lot of experience in this area before you inadvertently find yourself fined (or sued) into bankruptcy.
A lot of HIPAA complience also has to do with due dilegence. My organization recently when through a long period of training that covered everything from building access logs to the way we do employee password resets. Unfortunately there aren't hard, static rules that define it.
On the positive side- I've learned to love the compliance. Most of it is common sense things (like not giving out info over the phone to any random person) and has made our organization more efficient.
+1 do these things because they are actually good engineering practices. be a good custodian of any user's trust.
i think some companies try for the quick buck and in the name of cost savings run a shoddy operation. ymmv.
ps - do not try making said quick buck in health care. contrary to VC bets otherwise, it doesnt exist. plan for a very very long haul.
This exactly. It's not like there are just a few commands to run in Linux that gets you a HIPAA-compliant server. It is a pretty long and arduous process that involves several business-level requirements, in addition to the technical ones.