I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to bounce some ideas off of you guys.
The basic spirit of HIPAA from what I have read:
- Ensure only authorized people can access PHI.
- Ensure data in transport and at rest is encrypted.
I've done some googling (AWS whitepaper, hipaa hosting, etc) and was wondering what you guys thought of the following scheme:
- Rails front end application code (Heroku/AWS) that handles all the client requests, all phi sent over HTTPS.
- Data sent to a centralized encryption server to be encrypted.
- Encryption server sends encrypted data to the database server (AWS probably).
This would allow me to offload most of the server hardening onto the encryption server, as well as separate the keys from the data. Does anyone have any experience/insight in setting up a system such as this? Or even a system like this for HIPAA specifically? Is it even a good idea from a security standpoint? Also I've been hard pressed to find a company that simply hosts an "encryption server", are there any companies that specialize in something like that?