note that state privacy laws, or the use of creidt cards (PCI) will largely require most of this so in broad terms, if you comply with PCI and NY/CA privacy requirements, you pass HIPAA muster.
the rest is really basic good practice for any professional-grade service that is entrusted with customer data
i respect that someone is trying to market a prepackaged solution but i would advise against shortcuts. you (the developer/owner/cto) should take the time to understand your stack from bere metal up, and be able to explain the risks that are real vs academic, the financial impact of attacks or internal employee mistakes/theft, and the real cost and benefits of devops done right.
you owe it to your customers, your shareholders, your employees and yourself to invest the mental energy to really understand the nuances.
otherwise, dont go into health care markets.
(i like to think we take our work as seriously as the best MDs, so would you want your surgeoun taking shortcuts or trying to build a MVP?)
Comments
note that state privacy laws, or the use of creidt cards (PCI) will largely require most of this so in broad terms, if you comply with PCI and NY/CA privacy requirements, you pass HIPAA muster.
the rest is really basic good practice for any professional-grade service that is entrusted with customer data
i respect that someone is trying to market a prepackaged solution but i would advise against shortcuts. you (the developer/owner/cto) should take the time to understand your stack from bere metal up, and be able to explain the risks that are real vs academic, the financial impact of attacks or internal employee mistakes/theft, and the real cost and benefits of devops done right.
you owe it to your customers, your shareholders, your employees and yourself to invest the mental energy to really understand the nuances.
otherwise, dont go into health care markets.
(i like to think we take our work as seriously as the best MDs, so would you want your surgeoun taking shortcuts or trying to build a MVP?)