Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

HIPAA Security Hounds...How would you view an AWS deployment that included a set of systems deployed together at AWS (within a single, secured Virtual Private Cloud), using a key to encrypt all storage, and only allowing authenticated users to access anything related to the deployment, and using SSL certificates (or IPsec VPN) to encrypt all traffic to and from the server systems?

If that does comply with the laws regarding of data storage and transmission of HIPAA/HITECH, and the organization properly documents and trains it's employees, are there still "open doors" from a security standpoint that should be addressed?

share|improve this question
add comment

1 Answer

I know we don't typically like links as answers and we don't offer legal advice, however, AWS has a white paper on HIPAA specifically at http://aws.amazon.com/about-aws/whats-new/2009/04/06/whitepaper-hipaa/. The short answer is that Amazon believes it to be legally doable.

share|improve this answer
    
Thanks AJ- While I agree with Amazon's perspective, they are publishing this as the vendor of the service itself- As a result of their configuration, they do not sign BA's with HIPAA Covered entities, so gathering opinions (and sharing any facts uncovered on this issue) could save millions of dollars for many companies housing PHI. –  JoeD Jan 17 '13 at 20:39
    
@JoeD - that's true, but at the same time, if they published a white paper with significant problems in it, it would look very bad for them. IANAL, but claiming to be able to be HIPPA compliant might even have some legal baring since they are responsible for the physical security side of things for their servers. They do also have several case studies of other companies doing it. –  AJ Henderson Jan 17 '13 at 21:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.