Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows:

  1. Client goes to the bank and gets a merchant account.
  2. Merchant tells the client to use some random "authorized scanning vendor" (ASV) (i.e. TrustWave) to scan the server and site.
  3. The ASV runs an automated scan that finds a bunch of random "vulns" such as old versions of software or the ability to list directories. The better ones actually scan the site for XSS and other web vulns.
  4. The client sends me a PDF depicting all the vulns.
  5. I lock down the server & report all the backports.
  6. The ASV runs the scanner again and signs off on it.
  7. PROFIT!

The way I see PCI is a "Cover Your Ass" type of thing. An authorized ASV signs off saying the site is "secure" thus deflecting some responsibility off the client.

With that being said, how does HIPPA compliance work? Let's say Joe the doctor came to me and said "Make my office HIPPA compliant." I know security but where would I start from the legal sense? Are there any "Authorized" HIPPA organizations that do scans and sign off that the organization is secure? Are there any hard coded rules (i.e. passwords must expire BEFORE n days)? Could I even help Joe out or must I be certified in some way?

Please briefly explain HIPPA compliance in the practical sense.

I am not doing anything for a client, I am just curious since this topic is very ambiguous and I have no experience in it.

share|improve this question
add comment

1 Answer

HIPAA compliance is a little more complicated. There are minimum security standards with regards to configuration in the network, systems and physical security domains which must be met before your organization may be certified "HIPAA Compliant". There are too many to list here, but to give you an idea, here's a few line items.

On the network side, such minimum security standards include:

  • Separate VLAN for medical records / medical device traffic
  • Access Control Lists with default-deny, restricting access to medical VLAN
  • Default-deny access policies (users must be explicitly granted access)

On the systems side:

  • Workstations auto-lock their screens after X minutes (usually <15)
  • Users are required to change passwords every X days (usually 90)
  • Granular permissions for network shares, with default-deny

On the physical side:

  • Physical access to network/systems maintenance areas must be secured through lock & key at minimum, two-factor preferred
  • Security cameras must monitor building entrances and server/network rooms

On the administrative side:

  • Terminated employee credentials must be revoked same-day
  • Employee background checks must be conducted, by a vetted agency

...and the list goes on-and-on. That's just the tip of the iceberg.

Generally, the network/systems security requirements follow the NIST SCAP guides: security checklists of "best practices", which may be found here:

NOTE: Large parts of these websites are unavailable during the government shutdown.

EDITed to add:

In a legal sense, you'll need to ensure that you follow all the guidelines. This is the "due diligence" for HIPAA compliance. See here

Note that if the Department of Health & Human Services audits you and finds security compliance issues, your organization may find itself on the wrong side of more than one regulatory body.

EDIT 2: Also note that "certification" by a third party does not absolve the business entity from any responsibility relating to HIPAA compliance.

share|improve this answer
    
Thanks for the detailed explanation. Is it standard practice to get "certified" by a 3rd party similar to PCI? I wonder if there's any kind of documentation I must keep to prove I did those things (the doctor claim I misconfigured)? I do Managed Services\IT consulting for small businesses but I think I'm going to steer clear of doctors. Too much risk to be sued if I miss a minute detail. I know for a FACT small doctors (many with cloud EMR) don't do all that stuff you mentioned (no cameras, workstations in the exam room that stay open all the time). –  hippa-hippo Oct 12 '13 at 12:45
    
Yeah, it's a good idea to get "certified" by a 3rd party agency - specifically one that specializes in HIPAA compliance. It's a pretty in-depth process, and you'd benefit from having a set of eyes that's already familiar with the material. It helps ensure that you've covered every avenue. –  Panther Modern Oct 12 '13 at 15:42
    
Would you even consider doing basic IT (backups, maintenance, patches, etc.) for a small doctors office, or would you say it opens up too many cans of worms unless you are absolutely familiar with the intricacies of HIPPA? I would just hate for the idiot receptionist to bring in some malware laden laptop or fails to comply with the policies I set for them and I end up getting sued. –  hippa-hippo Oct 12 '13 at 15:58
    
Unless you're already HIPAA "certified" yourself (ie: gone through a training and certification course for it), I'd recommend handing it off to someone else: healthcare (like any .gov regulated industry) carries with it all sorts of legal cans-of-worms which have a tendency to open themselves with regularity. Best of luck! –  Panther Modern Oct 12 '13 at 16:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.