0

I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database infrastructure lives in my own AWS account which is properly setup to be HIPAA compliant, per Vanta. I don't intend to have any PHI within Vercel's infrastructure -- the frontend will make calls to the backend but this comes from the user's browser.

Is this a kosher setup for HIPAA compliance? I assume I wouldn't be able to SSR anything that includes PHI, is that correct?

Improve this question

1 Answer 1

Reset to default
1

I asked the Security team in our company (Platform.sh) what they advise in such cases. Here's what they responded:

You can probably make something like that work but you need to be careful so that no PHI passes through the non-HIPAA part of your infrastructure. Compliance and security-wise in general, it's best to avoid scenarios that are easy to mess up, so using a HIPAA-compliant party would be preferred for me.

If the website is just hosting general data, then it's fine but the moment anyone's personal info is passed, then it has to be HIPAA compliant. The best course of action, to be on the safe side, would be to have it all in one place.

Disclaimer: Platform.sh is a secured PaaS for web applications, and is a competitor to Vercel.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .