No post body was provided.
Ask HN: How do I set up a HIPAA-compliant server?
1–10 of 54 posts
Re: Ask HN: How do I set up a HIPAA-compliant server?
#2Here is some info about doing it on AWS
Re: Ask HN: How do I set up a HIPAA-compliant server?
#3It's a big task on its own and it seems a bit in-transparent to me.
However, you may want to have a look at TrueVault[0] which has been featured on HN[1].
Re: Ask HN: How do I set up a HIPAA-compliant server?
#4It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more.
I'd suggest you work with a company that has a lot of experience in this area before you inadvertently find yourself fined (or sued) into bankruptcy.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#5We have been very pleased with the True Vault solution and the responsiveness of the team when needed, worth looking into for your needs.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#6@USNetizen -- You're right...I should have clarified that I want to know how to get an entire stack up and running, although I don't trust myself to do this unassisted.
I'm just surprised at how few resources there are that explain what it takes, and I hope that someday soon, healthcare startup CTO's will be referred to clearly documented open source solutions that are fairly fool-proof, rather than paid-for services (@sebst). Amazon's compliance page is unfortunately uninformative (@byoung2).
Re: Ask HN: How do I set up a HIPAA-compliant server?
#7We used to use a hosting company Layered Tech that had a HIPPA compliant offering. If you need HIPPA compoanxe I suggest getting it as a managed service.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#8I'd just have someone else do it for me. There are many "enterprise" level hosting companies that can help you with that.
I believe that rackspace has a pretty program around compliance.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#9@USNetizen -- You're right...I should have clarified that I want to know how to get an entire stack up and running, although I don't trust myself to do this unassisted. I'm just surprised at how few resources there are that explain what it takes, and I hope that someday soon, healthcare startup CTO's will be referred to clearly documented open source solutions that are fairly fool-proof, rather than paid-for services…
You're absolutely right in that regard. I actually started my company to help out others in a similar situation, but there should be an easier way to go about getting set up initially. Even many small/mid-size medical offices don't know what it takes from a technology perspective to be fully compliant, let alone other startups.
The only reason I have been able to navigate HIPAA/HITECH is because I've worked many years previously as a software engineer and then a senior technology manager for a very large hospital network and dealt with these requirements daily.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#10It's not just the server - it's the storage, accessibility (compartmentalization), and transmission of sensitive data (PHI and PII) at all levels. There is a lot more to HIPAA/HITECH than just server configuration - there are legal agreements you have to enter into as well (BAA's), insurance requirements, and potentially a lot more. I'd suggest you work with a company that has a lot of experience in this area before…
This exactly. It's not like there are just a few commands to run in Linux that gets you a HIPAA-compliant server. It is a pretty long and arduous process that involves several business-level requirements, in addition to the technical ones.