7

We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) data.

I would like to know if HIPAA recommends in isolating database per client(Provider/Practice) - ie is a single database for every client a security breach of HIPAA rules and regulations?

Improve this question
2
  • Are you hosting and controlling everything or using a third party provider for hosting?
    – Eric G
    Commented Apr 3, 2014 at 19:53
  • We own a datacenter. Most probably we will be hosting the same in our premise. If it is not feasible we will look into AWS or Firehost.
    – Arun Kumar
    Commented Apr 12, 2014 at 8:33

1 Answer 1

Reset to default
5

HIPAA doesn't specifically prohibit shared infrastructure.

If you are going to be a neutral firm offering SaaS to numerous practices, this architecture will be fine. Ensure that your logical security is top notch such that no client can access data for any other client. This is fairly easy, but needs to be a deliberate, documented and demonstrable process. Ensure automated testing is in place to enforce these audits, heavily test your data access layer, etc.

Also, ensure your storage is encrypted.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .