If one big customer is demanding you be HIPAA compliant then they probably want to see a certification, and depending on size of customer they may be willing to provide funding for that certification. It takes months but the certifying service will provide consulting and training. Essentially it all about tight access controls, encrypting data at rest, and documenting everything and everyone who has access to the internals.
correct but hospitals and other buyers dont seem to know that and some do insist on "certification"....you can try to convince them but in my first hand experience the (uninformed, misinformed) customer is always right so you do have to provide something that claims to be a "certified" solition...typically by providing an outside audit report
Comments
If one big customer is demanding you be HIPAA compliant then they probably want to see a certification, and depending on size of customer they may be willing to provide funding for that certification. It takes months but the certifying service will provide consulting and training. Essentially it all about tight access controls, encrypting data at rest, and documenting everything and everyone who has access to the internals.
There is no such thing as a HIPAA certification.
correct but hospitals and other buyers dont seem to know that and some do insist on "certification"....you can try to convince them but in my first hand experience the (uninformed, misinformed) customer is always right so you do have to provide something that claims to be a "certified" solition...typically by providing an outside audit report