As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc.
With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server.
HIPAA has three main rules you need to comply with:
1. The Privacy Rule - Governs the use and disclosure of PHI (protected health information). Applies to all forms of PHI (verbal, written, electronic, etc.).
2. The Security Rule - Governs safeguards for electronic PHI
3. The Breach Notification Rule - Governs your responsibilities during a security or privacy incident
The Security Rule has a general security standard, some documentation/retention rules, and three sections of safeguards. They are:
1. Administrative Safeguards
2. Physical Safeguards
3. Technical Safeguards
Some of the safeguards are mandatory. Some are "addressable," meaning if you don't implement them you must document why you chose not to and what other safeguards you applied instead.
Most likely, you're going to start with something like the following for your servers:
1. Sign a BAA with any service provider who is going to touch PHI for you.
2. Restrict physical and logical server access to authorized individuals. Document how you restrict access and why the methods chosen are reasonable and appropriate given the risk posture of your organization. (There's a LOT packed into this step.)
3. Log all access and data modification events. If you use a logging service that isn't HIPAA-compliant, make sure you're not including PHI data you send them.
4. Encrypt data at rest and in transit, including inside the network perimeter. Document your network topology and access points.
5. Implement backups according to your organization's HIPAA contingency/disaster recovery plan. Document the backup scheme.
A few caveats:
- I haven't addressed application-level security. The same requirements apply, but the implementation differs.
- Your customers will demand additional safeguards that aren't in HIPAA.
At Aptible, we help with all of this, plus all of the other requirements (risk assessment, policies, training, etc.), so you can get a complete handle on your compliance status.
Where I work at Catalyze, we offer a starting package beginning at $500/mo that includes one database container and one server. Or, if your application only required a secure backend, prices start as cheap as $100/month. We have a calculator here to compare prices: https://catalyze.io/platform-as-a-service/
We've been building applications with both startups and large healthcare organizations like the VA. I'd love to talk with you more to see what your needs are. Feel free to hit me with an email (mark@catalyze.io) with any questions.
That's the most that we have on the calculator, but we can help you with whatever your need. Email me (mark@catalyze.io) and we can work with you to meet your infrastructure needs.
This is all great advise. I would just strongly emphasize that HIPAA compliance has significantly more to do with the soft guidelines than meeting technical specifications.
Part of what makes HIPAA compliance challenging from a techies perspective is that there are very few proscriptive rules. A lot of implementation is left up to the provider to provide flexibility but the justification for all those decisions needs to be defensible.
A couple last items I would add:
Not only do you need a BAA with any service provider you use you will also need one for any contractor who has access to PHI you are responsible for. As of the latest set of rules this also applies to any subcontractors that your contractors may use.
You will also need named privacy and security officers who are responsible for the overall program and will be the first ones HHS and OCR will ask for should you be audited.
Depending on what function you are providing for HIPAA-covered entities, you may need to also deal with the Transactions and Code Sets rule, though the rules related to PHI are usually all people are aware of.
One should also note that the Breach Notification rule, through its definition of what constitutes unsecured PHI, actually sneaks in technical requirements that entities dealing with PHI probably should treat as near-mandatory for encryption, etc., since, even though they aren't strictly mandatory, significantly impact the likelihood of a reportable breach.
Curious-- do you define a running database system (e.g. MySQL) to contain "data at rest", "data in transit" or neither?
My reading says "neither". Conservative move is "encrypt everything" but curious if others have passed/failed a HIPAA audit with a standard MySQL or SQL Server system (assuming you have individual ID access & logging).
note that state privacy laws, or the use of creidt cards (PCI) will largely require most of this so in broad terms, if you comply with PCI and NY/CA privacy requirements, you pass HIPAA muster.
the rest is really basic good practice for any professional-grade service that is entrusted with customer data
i respect that someone is trying to market a prepackaged solution but i would advise against shortcuts. you (the developer/owner/cto) should take the time to understand your stack from bere metal up, and be able to explain the risks that are real vs academic, the financial impact of attacks or internal employee mistakes/theft, and the real cost and benefits of devops done right.
you owe it to your customers, your shareholders, your employees and yourself to invest the mental energy to really understand the nuances.
otherwise, dont go into health care markets.
(i like to think we take our work as seriously as the best MDs, so would you want your surgeoun taking shortcuts or trying to build a MVP?)
I came to this thread with the intention to say, "Call Chas and Frank at Aptible! They're nice folk with a product that does only exactly what you are asking for."
Considering what we know about deployed systems in general, is it likely that current systems actually comply, or are merely privacy disasters waiting to explode?
Comments
(Disclosure: I'm a co-founder of Aptible.)
As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc.
With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server.
HIPAA has three main rules you need to comply with:
1. The Privacy Rule - Governs the use and disclosure of PHI (protected health information). Applies to all forms of PHI (verbal, written, electronic, etc.).
2. The Security Rule - Governs safeguards for electronic PHI
3. The Breach Notification Rule - Governs your responsibilities during a security or privacy incident
The Security Rule has a general security standard, some documentation/retention rules, and three sections of safeguards. They are:
1. Administrative Safeguards
2. Physical Safeguards
3. Technical Safeguards
Some of the safeguards are mandatory. Some are "addressable," meaning if you don't implement them you must document why you chose not to and what other safeguards you applied instead.
Most likely, you're going to start with something like the following for your servers:
1. Sign a BAA with any service provider who is going to touch PHI for you.
2. Restrict physical and logical server access to authorized individuals. Document how you restrict access and why the methods chosen are reasonable and appropriate given the risk posture of your organization. (There's a LOT packed into this step.)
3. Log all access and data modification events. If you use a logging service that isn't HIPAA-compliant, make sure you're not including PHI data you send them.
4. Encrypt data at rest and in transit, including inside the network perimeter. Document your network topology and access points.
5. Implement backups according to your organization's HIPAA contingency/disaster recovery plan. Document the backup scheme.
A few caveats:
- I haven't addressed application-level security. The same requirements apply, but the implementation differs.
- Your customers will demand additional safeguards that aren't in HIPAA.
At Aptible, we help with all of this, plus all of the other requirements (risk assessment, policies, training, etc.), so you can get a complete handle on your compliance status.
¡Ay, caramba!
Thanks for at least giving me a source to cite in grant applications!
Where I work at Catalyze, we offer a starting package beginning at $500/mo that includes one database container and one server. Or, if your application only required a secure backend, prices start as cheap as $100/month. We have a calculator here to compare prices: https://catalyze.io/platform-as-a-service/
We've been building applications with both startups and large healthcare organizations like the VA. I'd love to talk with you more to see what your needs are. Feel free to hit me with an email (mark@catalyze.io) with any questions.
Good luck!
Hmmm... 8GB max? That doesn't cut it for the amount of claims data I generally deal with. Any rationale behind that limit?
That's the most that we have on the calculator, but we can help you with whatever your need. Email me (mark@catalyze.io) and we can work with you to meet your infrastructure needs.
This is all great advise. I would just strongly emphasize that HIPAA compliance has significantly more to do with the soft guidelines than meeting technical specifications.
Part of what makes HIPAA compliance challenging from a techies perspective is that there are very few proscriptive rules. A lot of implementation is left up to the provider to provide flexibility but the justification for all those decisions needs to be defensible.
A couple last items I would add: Not only do you need a BAA with any service provider you use you will also need one for any contractor who has access to PHI you are responsible for. As of the latest set of rules this also applies to any subcontractors that your contractors may use.
You will also need named privacy and security officers who are responsible for the overall program and will be the first ones HHS and OCR will ask for should you be audited.
Depending on what function you are providing for HIPAA-covered entities, you may need to also deal with the Transactions and Code Sets rule, though the rules related to PHI are usually all people are aware of.
One should also note that the Breach Notification rule, through its definition of what constitutes unsecured PHI, actually sneaks in technical requirements that entities dealing with PHI probably should treat as near-mandatory for encryption, etc., since, even though they aren't strictly mandatory, significantly impact the likelihood of a reportable breach.
Curious-- do you define a running database system (e.g. MySQL) to contain "data at rest", "data in transit" or neither?
My reading says "neither". Conservative move is "encrypt everything" but curious if others have passed/failed a HIPAA audit with a standard MySQL or SQL Server system (assuming you have individual ID access & logging).
note that state privacy laws, or the use of creidt cards (PCI) will largely require most of this so in broad terms, if you comply with PCI and NY/CA privacy requirements, you pass HIPAA muster.
the rest is really basic good practice for any professional-grade service that is entrusted with customer data
i respect that someone is trying to market a prepackaged solution but i would advise against shortcuts. you (the developer/owner/cto) should take the time to understand your stack from bere metal up, and be able to explain the risks that are real vs academic, the financial impact of attacks or internal employee mistakes/theft, and the real cost and benefits of devops done right.
you owe it to your customers, your shareholders, your employees and yourself to invest the mental energy to really understand the nuances.
otherwise, dont go into health care markets.
(i like to think we take our work as seriously as the best MDs, so would you want your surgeoun taking shortcuts or trying to build a MVP?)
I came to this thread with the intention to say, "Call Chas and Frank at Aptible! They're nice folk with a product that does only exactly what you are asking for."
How are y'all? What's the latest?
Life is good, just hanging out on a Sunday afternoon, geeking out about HIPAA. What could be better? Pretty much normal for us :)
Considering what we know about deployed systems in general, is it likely that current systems actually comply, or are merely privacy disasters waiting to explode?
boom