I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows:

  1. Client goes to the bank and gets a merchant account.
  2. Merchant tells the client to use some random "authorized scanning vendor" (ASV) (i.e. TrustWave) to scan the server and site.
  3. The ASV runs an automated scan that finds a bunch of random "vulns" such as old versions of software or the ability to list directories. The better ones actually scan the site for XSS and other web vulns.
  4. The client sends me a PDF depicting all the vulns.
  5. I lock down the server & report all the backports.
  6. The ASV runs the scanner again and signs off on it.
  7. PROFIT!

The way I see PCI is a "Cover Your Ass" type of thing. An authorized ASV signs off saying the site is "secure" thus deflecting some responsibility off the client.

With that being said, how does HIPAA compliance work? Let's say Joe the doctor came to me and said "Make my office HIPAA compliant." I know security but where would I start from the legal sense? Are there any "Authorized" HIPAA organizations that do scans and sign off that the organization is secure? Are there any hard coded rules (i.e. passwords must expire BEFORE n days)? Could I even help Joe out or must I be certified in some way?

Please briefly explain HIPAA compliance in the practical sense.

I am not doing anything for a client, I am just curious since this topic is very ambiguous and I have no experience in it.

  • Ask your legal team: What do I need to do, so I don't go to jail?
    – this.josh
    Commented May 31, 2014 at 8:33
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post.
    – Ali Ahmad
    Commented May 31, 2014 at 13:04
  • 1
    There is a fundamental problem with the question asker, and potentially others interested in the question; that HIPPA compliance, and by proxy system security is a checklist or certificate to hang on the wall. That compliance is a milestone on the way to profit. Failure on the part of technology builders to address user's privacy or security has real and lasting impact on the users. For those who don't take their responsibility seriously, the only emphasis they understand is risk to their own self-interest.
    – this.josh
    Commented Jun 1, 2014 at 8:14
  • While I agree with the spirit of this question (and the whole topic of compliance for compliance sake), I would have to concur with the flags : this doesn't answer the question itself. Moving to comment.
    – Rory Alsop
    Commented Jun 1, 2014 at 15:50

1 Answer 1


HIPAA compliance is a little more complicated. There are minimum security standards with regards to configuration in the network, systems and physical security domains which must be met before your organization may be certified "HIPAA Compliant". There are too many to list here, but to give you an idea, here's a few line items.

On the network side, such minimum security standards include:

  • Separate VLAN for medical records / medical device traffic
  • Access Control Lists with default-deny, restricting access to medical VLAN
  • Default-deny access policies (users must be explicitly granted access)

On the systems side:

  • Workstations auto-lock their screens after X minutes (usually <15)
  • Users are required to change passwords every X days (usually 90)
  • Granular permissions for network shares, with default-deny

On the physical side:

  • Physical access to network/systems maintenance areas must be secured through lock & key at minimum, two-factor preferred
  • Security cameras must monitor building entrances and server/network rooms

On the administrative side:

  • Terminated employee credentials must be revoked same-day
  • Employee background checks must be conducted, by a vetted agency

...and the list goes on-and-on. That's just the tip of the iceberg.

Generally, the network/systems security requirements follow the NIST SCAP guides: security checklists of "best practices", which may be found here:

NOTE: Large parts of these websites are unavailable during the government shutdown.

EDITed to add:

In a legal sense, you'll need to ensure that you follow all the guidelines. This is the "due diligence" for HIPAA compliance. See here

Note that if the Department of Health & Human Services audits you and finds security compliance issues, your organization may find itself on the wrong side of more than one regulatory body.

EDIT 2: Also note that "certification" by a third party does not absolve the business entity from any responsibility relating to HIPAA compliance.

  • Thanks for the detailed explanation. Is it standard practice to get "certified" by a 3rd party similar to PCI? I wonder if there's any kind of documentation I must keep to prove I did those things (the doctor claim I misconfigured)? I do Managed Services\IT consulting for small businesses but I think I'm going to steer clear of doctors. Too much risk to be sued if I miss a minute detail. I know for a FACT small doctors (many with cloud EMR) don't do all that stuff you mentioned (no cameras, workstations in the exam room that stay open all the time). Commented Oct 12, 2013 at 12:45
  • Yeah, it's a good idea to get "certified" by a 3rd party agency - specifically one that specializes in HIPAA compliance. It's a pretty in-depth process, and you'd benefit from having a set of eyes that's already familiar with the material. It helps ensure that you've covered every avenue. Commented Oct 12, 2013 at 15:42
  • Would you even consider doing basic IT (backups, maintenance, patches, etc.) for a small doctors office, or would you say it opens up too many cans of worms unless you are absolutely familiar with the intricacies of HIPPA? I would just hate for the idiot receptionist to bring in some malware laden laptop or fails to comply with the policies I set for them and I end up getting sued. Commented Oct 12, 2013 at 15:58
  • 2
    Unless you're already HIPAA "certified" yourself (ie: gone through a training and certification course for it), I'd recommend handing it off to someone else: healthcare (like any .gov regulated industry) carries with it all sorts of legal cans-of-worms which have a tendency to open themselves with regularity. Best of luck! Commented Oct 12, 2013 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .