Running a Startup on AWS? Get Funding With AWS JumpStart. Click Here to Learn More

2021 Fillmore Street #1128

}

24/7 solutions

HIPAA Compliance in the Cloud

Joel Garcia Joel Garcia has been building AllCode since 2015. He’s an innovative, hands-on executive with a proven record of designing, developing, and operating Software-as-a-Service (SaaS), mobile, and desktop solutions. Joel has expertise in HealthTech, VoIP, and cloud-based solutions. Joel has experience scaling multiple start-ups for successful exits to IMS Health and Golden Gate Capital, […]

HIPAA Compliance for digital health startups is important.

In this blog post, we’ll define HIPAA, PHI, and HIPAA Compliance. We’ll then provide practical examples of PHI. We will specify some steps that need to be taken to secure PHI in a cloud environment. We’ll then begin to discuss some of the 3rd party vendors that offer different compliance solution.
The HIPAA Privacy Rule protects most “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, on paper, or oral. The Privacy Rule calls this information protected health information (PHI)2.
Practical examples of PHI are

  • Patient names
  • Addresses — In particular, anything more specific than state, including street address, city, county, precinct, and in most cases zip code, and their equivalent geocodes.
  • Dates — Including birth, discharge, admittance, and death dates.
  • Telephone and fax numbers
  • Email addresses
  • Social Security numbers
  • Driver’s License information
  • Medical record numbers
  • Account numbers
  • Health plan beneficiary numbers
  • Certification/license numbers
  • Vehicle identifiers and serial numbers, including license plate numbers
  • Device identifiers and serial numbers
  • Names of relatives
  • Internet Protocol (IP) address numbers
  • Biometric identifiers — including finger and voice prints.
  • Full face photographic images and any comparable images.

When your cloud application makes use of PHI, then your cloud application must take additional security steps to protect the PHI. These steps include:

  • Managing encryption at rest and in transit.
  • Encrypting database backups
  • Centralized Access Control system to audit who has access to the the PHI

There is a also a compliance angle to HIPAA. You can tell a vendor that you are compliant, but how do you prove it? In order to demonstrate HIPAA Compliance. You will invariably need to sign a Business Associate Agreement (BAA). The BAA will attest that the PHI provided to you will be protected, audited, used by professionals are educated on PHI, and have documented processes. You will need the following:

  • Automated Risk Assessment
  • Policy Procedures
  • Training for your workforce.
  • Incident Response Tool - Policy in place.
  • Intrusion detection software.

There are a number of different options in the cloud:
Aptible -  https://www.aptible.com - HIPAA Compliant Docker Container Solution
TrueVault - https://www.truevault.com - HIPAA Compliant Secure API to Store Health Data.
ClearDATA - https://www.cleardata.com - Healthcare Management Platform that resides on AWS.
AWS Snowball - https://aws.amazon.com/snowball/ - AWS Snowball enables you to to transfer large amounts of data, including Protected Health Information, into and out of the AWS Cloud in a secure and cost-effective manner

Joel Garcia
Joel Garcia

Joel Garcia has been building AllCode since 2015. He’s an innovative, hands-on executive with a proven record of designing, developing, and operating Software-as-a-Service (SaaS), mobile, and desktop solutions. Joel has expertise in HealthTech, VoIP, and cloud-based solutions. Joel has experience scaling multiple start-ups for successful exits to IMS Health and Golden Gate Capital, as well as working at mature, industry-leading software companies. He’s held executive engineering positions in San Francisco at TidalWave, LittleCast, Self Health Network, LiveVox acquired by Golden Gate Capital, and Med-Vantage acquired by IMS Health.

Related Articles

Here’s Why You Should Work with an AWS Partner

Here’s Why You Should Work with an AWS Partner

Amazon Web Services is understandably a difficult platform to adapt to and utilize fully upon first getting started. Some organizations can be selected to become certified partners to indirectly extend services to help build on the Amazon Cloud. Finding a certified company to help build out is undoubtedly the best way to significantly simplify, streamline, and reduce the cost of utilizing AWS.

Amazon Web Services – CodeCatalyst

Amazon Web Services – CodeCatalyst

When a development team is building out an application, it helps to have access to the same resources, have the tools for planning and testing, and to have access to the application all in one place. CodeCatalyst comes with a slew of continuous integration/continuous development (CI/CD) tools and can leverage other AWS services and be connected to other AWS projects on an account. As a collaborative tool, it is easy to introduce new members into the project and to log all activity or all tests from a single dashboard. It’s a complete package of all the tools needed to securely work on every step of an application’s lifecycle.

The Definitive Guide to AWS Pricing

The Definitive Guide to AWS Pricing

Perhaps the biggest issue with AWS that its competitors edge out on is the confusing pricing model. It does promise the capacity to help users save significantly on funds that otherwise by avoiding spending on unnecessary resources, but getting to that point isn’t always clear. We will be covering in greater detail how this works.

Download our 10-Step Cloud Migration ChecklistYou'll get direct access to our full-length guide on Google Docs. From here, you will be able to make a copy, download the content, and share it with your team.