I am trying to bring a company up to HIPAA standards and help them secure their customer health information. A question that sometimes comes up is that developers want to take databases of customer's data and store it on their computers and work with it.

I have always said no to this because I cannot control what happens on their computers. Even if it's a work computer, I do not control the network that it is in ; Because of this I am public enemy number 1 again.

What are some solutions that would maintain compliance and handle data securely and allow developers to continue to work on the data that we receive?

2 Answers 2


Hi there Aperture Security,

First off I can assure you, you are not public enemy number one and where patient data is involved it is better to be safe than sorry.

That being said there is also a need for developers to be able to work from home so I would not leave them without that option. A possible solution is implement work computers that when working off site are either secured through a VPN or are not able to connect to the network at all, also would recommend basic security education to be a second as funnily enough physical theft and clicking that weird email will be just as bad in offsite work as theft through network.


  • Irronically, this is what I've suggested that we do .
    – LUser
    Commented Dec 9, 2017 at 11:07
  • Well then hopefully they take you're opinion then, got to love it when developers don't care about security...
    – user165319
    Commented Dec 9, 2017 at 12:43

I find it very surprising that your "developers" routinely work with live data. Even when I have been working in unregulated environments, developers used dedicated databases, except in unusual and infrequent instances. It sounds like you have a bigger problem than just developers taking data home.

I am not familiar with the requirements of HIPAA, but as a first step I would be looking to provision easier access to anonymized datasets within your office.

Beyond that, I would suggest that allowing developers to host data (and other intellectual property) on their own machines is not a desirable outcome. And the easiest way to win this one is to make it easier for them to access the tools and data they need then to copy it elsewhere.

Rather than dictating solutions, you might start by establishing a set of constraints and talking to the developers about a solution.

  • Funny that you mention this . Last few times I did this , I suggested that all received test data be gleaned of important information. I have every time been shutdown for this. We are talking abot a solution , but I thought to ask here because I was sure people have gone through this before.
    – LUser
    Commented Dec 10, 2017 at 6:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .