I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS.
Do we need to encrypt the MySQL database in order to keep HIPAA compliance? I'm aware of HIPAA requirements for data at rest but I don't know how it applies to Amazon Web Services.
Do we need to encrypt MySQL database in order to keep HIPAA compliance?
Depending on how the entire system is built, it may not be required, but I hope that you do encrypt it.
First you need to identify what PHI (Protected health information) resides in your system and how it may travel through your system. Unless your clients already de-identified or anonymize the data sent to you it is a good assumption that every piece of data you receive is PHI.
A date of service and a patient's first name (or last name) included in a record make that record PHI.
If you believe you can protect the PHI in the database without encryption you need to be able to provide a good security argument that the PHI has other sufficient protections. Even if you can make that argument, the principle of defense in depth encourages additional protection (like encryption) in case your primary protection fails.
You really need to be talking to your company's legal team as HIPPA is a law and failure to comply with HIPAA requirements can result in civil and criminal penalties
