We have audited HIPAA compliant hosting, at a reasonable price:
Ask HN: How do I set up a HIPAA-compliant server?
21–30 of 54 posts
Re: Ask HN: How do I set up a HIPAA-compliant server?
#22(Disclosure: I'm a co-founder of Aptible.)
As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc.
With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server.
HIPAA has three main rules you need to comply with:
1. The Privacy Rule - Governs the use and disclosure of PHI (protected health information). Applies to all forms of PHI (verbal, written, electronic, etc.).
2. The Security Rule - Governs safeguards for electronic PHI
3. The Breach Notification Rule - Governs your responsibilities during a security or privacy incident
The Security Rule has a general security standard, some documentation/retention rules, and three sections of safeguards. They are:
1. Administrative Safeguards
2. Physical Safeguards
3. Technical Safeguards
Some of the safeguards are mandatory. Some are "addressable," meaning if you don't implement them you must document why you chose not to and what other safeguards you applied instead.
Most likely, you're going to start with something like the following for your servers:
1. Sign a BAA with any service provider who is going to touch PHI for you.
2. Restrict physical and logical server access to authorized individuals. Document how you restrict access and why the methods chosen are reasonable and appropriate given the risk posture of your organization. (There's a LOT packed into this step.)
3. Log all access and data modification events. If you use a logging service that isn't HIPAA-compliant, make sure you're not including PHI data you send them.
4. Encrypt data at rest and in transit, including inside the network perimeter. Document your network topology and access points.
5. Implement backups according to your organization's HIPAA contingency/disaster recovery plan. Document the backup scheme.
A few caveats:
- I haven't addressed application-level security. The same requirements apply, but the implementation differs.
- Your customers will demand additional safeguards that aren't in HIPAA.
At Aptible, we help with all of this, plus all of the other requirements (risk assessment, policies, training, etc.), so you can get a complete handle on your compliance status.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#23We have audited HIPAA compliant hosting, at a reasonable price: https://www.atlantic.net/hipaa-compliant-hosting/
I hope you point out to your customers that compliance is a lot more than just a hosting account. Everything from specifications of the design of your office network to policies for employees talking while on smoke breaks.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#24(Disclosure: I'm a co-founder of Aptible.) As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc. With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server. HIPAA has three main rules you need to comply with: 1. The Privac…
I came to this thread with the intention to say, "Call Chas and Frank at Aptible! They're nice folk with a product that does only exactly what you are asking for."
How are y'all? What's the latest?
Re: Ask HN: How do I set up a HIPAA-compliant server?
#25(Disclosure: I'm a co-founder of Aptible.) As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc. With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server. HIPAA has three main rules you need to comply with: 1. The Privac…
I came to this thread with the intention to say, "Call Chas and Frank at Aptible! They're nice folk with a product that does only exactly what you are asking for." How are y'all? What's the latest?
Life is good, just hanging out on a Sunday afternoon, geeking out about HIPAA. What could be better? Pretty much normal for us :)
Re: Ask HN: How do I set up a HIPAA-compliant server?
#26(Disclosure: I'm a co-founder of Aptible.) As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc. With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server. HIPAA has three main rules you need to comply with: 1. The Privac…
> $3500/month.
> $0.10/Hour Additional App/Database Containers $0.40/GB/Month Additional Storage.
¡Ay, caramba!
Thanks for at least giving me a source to cite in grant applications!
Re: Ask HN: How do I set up a HIPAA-compliant server?
#27(Disclosure: I'm a co-founder of Aptible.) As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc. With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server. HIPAA has three main rules you need to comply with: 1. The Privac…
Considering what we know about deployed systems in general, is it likely that current systems actually comply, or are merely privacy disasters waiting to explode?
Re: Ask HN: How do I set up a HIPAA-compliant server?
#28(Disclosure: I work at FireHost, not in sales!)
We sell cloud but focused on security, compliance, and performance. Check us out.
Re: Ask HN: How do I set up a HIPAA-compliant server?
#29[deleted]
Re: Ask HN: How do I set up a HIPAA-compliant server?
#30Thanks for all of your comments so far. Synopsis is...it's complicated. There are basically no straightforward guides and no reliable, tried-and-true open source solutions that can be deployed with minimal security expertise, at least with respect to the technical setup. Options are to go with a service company like Aptible or TrueVault, or fumble through vast amounts of obtuse technical and legal documentation, then…
Isn't "no solutions that can be deployed with minimal security expertise" just about the whole point of this compliance?
If you have minimal security expertise, then you're supposed to be treated as noncompliant. There are two valid options: have the security expertise (and be prepared to legally vouch for it that you have, and get insurance for cases if it turns out that your expertise wan't enough), or get the security expertise from someone else. Oh, and the third option is to stop handling any sensitive data at all if you aren't equipped to handle it.
The reason why HIPAA (and similar compliance issues in other domains) exist is to try to eliminate what you're proposing. Random companies with minimal security expertise shouldn't be handling such data themselves, period.