Ask HN: HIPAA Hosting?

#1

Post by kgrin » Mon, Oct 11, 2010, 6:45 PM UTC

My consulting company is working with a client to make some changes to their webapp (it's a health-care-related app - details aren't super-relevant). One of the items on their wishlist is "make it HIPAA-compliant". We're working with the client's lawyer to determine exactly what that means in practice, but it's clear that one of the items will be "host it on infrastructure other than the $10/mo. WebFaction plan".

The app itself is (relatively) simple systems-wise, so we don't really need a dedicated box and all the sysadmin and security headaches that come with it. But from my basic read of the HIPAA Security Rule, shared hosting (which abstracts away a lot of the sysadmin issues) won't cut it. We're primarily developers, not sysadmins, and certainly don't want to get into the server admin business on something with regulatory requirements.

Does anyone here have suggestions for either a host that can make this less painful (not even sure what that would entail), or a firm that specializes in the sysadmin side of things? (Preferably with HIPAA experience).

Re: Ask HN: HIPAA Hosting?

#2

Post by notmyname » Mon, Oct 11, 2010, 6:59 PM UTC

No shared hosting seems to imply that VPS won't cut it either--depends on what "shared hosting" really means. So you are left with looking for a dedicated hosting plan. I'd say check out a company like Rackspace (disclosure: I work there).

Re: Ask HN: HIPAA Hosting?

#3

Post by kgrin » Mon, Oct 11, 2010, 7:04 PM UTC

notmyname wrote: post #2

No shared hosting seems to imply that VPS won't cut it either--depends on what "shared hosting" really means. So you are left with looking for a dedicated hosting plan. I'd say check out a company like Rackspace (disclosure: I work there).

Happy to use Rackspace or another dedicated server provider... the trick is that we don't want to be responsible for, say, security patches to the kernel.

So really the question is: is there a company that'll manage the damn server(s) for us so that we get to deal with a nice, clean abstraction similar to shared hosting?

Basically I want a HIPAA-compliant Heroku (though in this case not for Ruby).

Re: Ask HN: HIPAA Hosting?

#4

Post by kls » Mon, Oct 11, 2010, 7:11 PM UTC

The first company that gets to a certified HIPAA and PCI hosting cloud is going to have to figure out what to do with the buckets of cash they have lying around. I think for the enterprise PCI certification will be the event that gets the big (non-tech) guys out of running their own infrastructure. I would imagine that it would be the same for medical. As for you immediate question, I am sorry I can't help I don't know who if anyone is doing this. I am still looking for a PCI certified cloud as a portion of my customers are Public companies and not having to work on all their different infrastructures and being able to provide them a hosted solution would be great for me, but there is no way I could get into managing a PCI certified hardware infrastructure just to achieve that goal.

Re: Ask HN: HIPAA Hosting?

#5

Post by icey » Mon, Oct 11, 2010, 7:47 PM UTC

kgrin wrote: post #3

notmyname wrote: post #2

No shared hosting seems to imply that VPS won't cut it either--depends on what "shared hosting" really means. So you are left with looking for a dedicated hosting plan. I'd say check out a company like Rackspace (disclosure: I work there).

Happy to use Rackspace or another dedicated server provider... the trick is that we don't want to be responsible for, say, security patches to the kernel. So really the question is: is there a company that'll manage the damn server(s) for us so that we get to deal with a nice, clean abstraction similar to shared hosting? Basically I want a HIPAA-compliant Heroku (though in this case not for Ruby).

It's not cheap, but Rackspace has people you can pay to do this sort of thing for you.

Re: Ask HN: HIPAA Hosting?

#6

Post by hmahncke » Mon, Oct 11, 2010, 7:54 PM UTC

HIPAA is more about documenting your intended process, and your actual actions, than it is about requiring any particular solutions provider. For example, it's entirely possible to build a HIPAA compliant web app on AWS:

http://aws.typepad.com/aws/2009/04/white-paper-creating-hipa...

My company is in the middle of this, and we haven't encountered any deal-breakers so far.

Re: Ask HN: HIPAA Hosting?

#7

Post by keyist » Mon, Oct 11, 2010, 7:54 PM UTC

Had to research this before. Firehost is one of the names that came up often:

http://www.firehost.com/secure-hosting/hipaa

Their plans start from $845 monthly.

No affiliation, just passing info along.

You can't just rely on the provider though. All the server hardening in the world wouldn't help with apps that don't comply fully. Some of the audit requirements are bound to be very specific to the nature of your app.

Re: Ask HN: HIPAA Hosting?

#8

Post by CWuestefeld » Mon, Oct 11, 2010, 7:54 PM UTC

notmyname wrote: post #2

No shared hosting seems to imply that VPS won't cut it either--depends on what "shared hosting" really means. So you are left with looking for a dedicated hosting plan. I'd say check out a company like Rackspace (disclosure: I work there).

depends on what "shared hosting" really means

I think that's the key.

My employer hopes that a virtual machine on a private VLAN, with a fully-encrypted virtual disk, qualifies. This seems reasonable to me, but reasonableness isn't necessarily a part of any regulation.

Re: Ask HN: HIPAA Hosting?

#9

Post by 16s » Mon, Oct 11, 2010, 7:55 PM UTC

kls wrote: post #4

The first company that gets to a certified HIPAA and PCI hosting cloud is going to have to figure out what to do with the buckets of cash they have lying around. I think for the enterprise PCI certification will be the event that gets the big (non-tech) guys out of running their own infrastructure. I would imagine that it would be the same for medical. As for you immediate question, I am sorry I can't help I don't kn…

As a point of clarification... HIPPA is a federal law. PCI is an industry standard (VISA, Mastercard, etc). That does not mean one is better than the other, I just wanted to clarify.

Re: Ask HN: HIPAA Hosting?

#10

Post by 16s » Mon, Oct 11, 2010, 7:59 PM UTC

One other issue to consider is that just because your hosting provider's infrastructure is HIPPA compliant doesn't mean your application is. There are still a ton of privacy issues within the application, plain text HTTP, user authentication, etc.