Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do I set up a HIPAA-compliant server?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 54 posts

Re: Ask HN: How do I set up a HIPAA-compliant server?

#11

Post by paco3346 »

USNetizen wrote: post #4

It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more. I'd suggest you work with a company that has a lot of experience in this area before…

A lot of HIPAA complience also has to do with due dilegence. My organization recently when through a long period of training that covered everything from building access logs to the way we do employee password resets. Unfortunately there aren't hard, static rules that define it.

On the positive side- I've learned to love the compliance. Most of it is common sense things (like not giving out info over the phone to any random person) and has made our organization more efficient.

Re: Ask HN: How do I set up a HIPAA-compliant server?

#13

Post by snorkel »

If one big customer is demanding you be HIPAA compliant then they probably want to see a certification, and depending on size of customer they may be willing to provide funding for that certification. It takes months but the certifying service will provide consulting and training. Essentially it all about tight access controls, encrypting data at rest, and documenting everything and everyone who has access to the internals.

Re: Ask HN: How do I set up a HIPAA-compliant server?

#16

Post by chasb »

th3o6a1d wrote: post #6

@USNetizen -- You're right...I should have clarified that I want to know how to get an entire stack up and running, although I don't trust myself to do this unassisted. I'm just surprised at how few resources there are that explain what it takes, and I hope that someday soon, healthcare startup CTO's will be referred to clearly documented open source solutions that are fairly fool-proof, rather than paid-for services…

I'm the co-founder of Aptible, a HIPAA-compliant PaaS that just went through YC. I'd be really happy to talk to you and help figure out what kinds of resources we could publish, for free, that would help CTOs in your position figure this out. Email is in my profile.

Re: Ask HN: How do I set up a HIPAA-compliant server?

#17

Post by kutienoo »

snorkel wrote: post #13

If one big customer is demanding you be HIPAA compliant then they probably want to see a certification, and depending on size of customer they may be willing to provide funding for that certification. It takes months but the certifying service will provide consulting and training. Essentially it all about tight access controls, encrypting data at rest, and documenting everything and everyone who has access to the int…

There is no such thing as a HIPAA certification.

Re: Ask HN: How do I set up a HIPAA-compliant server?

#18

Post by wyc »

There are a few options if you want HIPAA compliance. Note that "HIPAA compliance" is somewhat of a loaded term in that there aren't many super-technical benchmarks to meet, but a general "do-good" attitude including (but not limited to) some of the following points:

- Physical server isolation: you cannot have other instances sniffing around in your deallocated garbage memory.

- Encrypted data stores: physical theft of the server should not provide access to your data.

- Server providers who can sign a Business Associate Agreement: many hospitals and firms with medical data require this in their stipulations.

- Audit trails for database modifications, access, etc. Basically, log everything, and this has to be encrypted too if it contains protected health information (PHI).

- All PHI over HTTPS if you have a webapp. NO PHI OVER EMAIL OR HTTP.

- "Soft" guidelines such as password complexity measures, auto session expiration, disallowed multi-sessions.

Again, this is not an exhaustive list. You really need to check with a lawyer who knows this stuff. The fines are enormous (read: business-ending) if you break the rules.

How do you work to implement these? Well, find a host who is willing to sign a BAA. Here are the two major contenders I'm aware of:

- Use Amazon AWS; they're willing to sign a BAA with you and provide you the physical server isolation you need. However, this doesn't come cheap. Expect >$2,000/mo in costs to keep this configuration. Also, you'd better be a network pro or willing to learn how to manage VPCs correctly to provide proper network-level isolation for the databases.

- Use aptible.com (they happen to be a YC company, and I don't know of anyone else doing this). Frank & Chas (the founders) are very responsive and aim to provide a comprehensive package, including backups, audit trails, and even employee training. The Docker-based and heroku-like interface is very appealing:

https://support.aptible.com/hc/en-us/articles/202638630-Depl...

This option is still expensive. They host on AWS as well, so you're paying for the server costs + premium. However, this will still be a lot cheaper than hiring a competent sysadmin to make sure the execution is flawless.

Re: Ask HN: How do I set up a HIPAA-compliant server?

#20

Post by th3o6a1d »

Thanks for all of your comments so far. Synopsis is...it's complicated. There are basically no straightforward guides and no reliable, tried-and-true open source solutions that can be deployed with minimal security expertise, at least with respect to the technical setup.

Options are to go with a service company like Aptible or TrueVault, or fumble through vast amounts of obtuse technical and legal documentation, then hire a security expert to audit your homemade system and hope that everything goes OK. Both options, as they currently exist, require a fair amount of $$$.

Post reply on HN