Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

How do we make a iPhone app HIPAA compliant. Our website is HIPAA compliant since we use encryption at rest, we use SSL, and other security provisions.

Will using a SSL connection give us the advantage? Also, i believe that the iPhone provides encryption regardless if a phone is protected or not?

share|improve this question

2 Answers

up vote 2 down vote accepted

I can't give you the full answer, but the short version that the lawyer at my previous hospital gave me was:

SSL will protect the data that is being transferred, however, anything that is cached to the SD card/Hard Drive is not encrypted...

So, when looking at this application, you will also have to encrypt what is stored on the phone by the app. If you have ever plugged an iPhone into your computer (or a friends), you have access to the full set of storage (including the OS), which means anything cached is available if the phone is lost.

I would look carefully at encrypting at least any PKI, PHI or PII that your program provides to the device.

The problem is that even if the program doesn't store data, the web interface can cache data going to and from the device. This is the part that could cause you problems.

share|improve this answer
Hey, thats the thing. We are not storing any info on the app. the app will pull data from website but will never store anything. after authentication it will display data from database. For our servers, we do use encryption at rest so even if the data is not being shown it is encrypted with 256 bit security. – ariel May 3 '12 at 22:38
The problem is that even if the program doesn't store data, the web interface can cache data going to and from the device. This is the part that could cause you problems. – powelljf3 May 4 '12 at 0:01
Hmmm. But if we use SSL connection for data going to and from the device, then its encrypted, thus making it a secure app? – ariel May 4 '12 at 0:03
SSL is only the transfer, what the app uses on the device is not encrypted just because what is transferred is. If the app uses no cache and you use SSL, you could be safe, the simple fact is that almost all apps cache data prior to transmitting it. Therefore, you would have unencrypted data on your device. – powelljf3 May 4 '12 at 1:15
OK, that makes sense. I will need to engage a security consultant to see how this can work. Thanks man. – ariel May 4 '12 at 3:22
show 5 more comments
up vote 2 down vote

The only answer is be fully compliant with HIPAA law and only let individuals who should have permitted use to protected patient data to have access to it in a secure and audited manner. At the very least read, http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

Listing a couple technologies (SSL ; disk-encryption) in use does not make you HIPAA compliant. Make sure you are not unintentionally sharing data with any third parties (e.g., hosting on a cloud platform) that you do not have signed business associate's agreements (BAAs) with. Do not store protected data on unencrypted phones. Make sure your app isn't subject to basic SQL injection/privilege escalation type attacks, monitor user activity for strange behavior, report disclosures, etc.

share|improve this answer
Hey, sorry for the mistake on my part in not clarifying but when i mentioned "other security provisions"; we are doing all above the above like preventing SQL injecitons, networking monitoring, etc. The website is not the problem, its the mobile iphone app that is the issue here. – ariel May 3 '12 at 21:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.