I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows:
- Client goes to the bank and gets a merchant account.
- Merchant tells the client to use some random "authorized scanning vendor" (ASV) (i.e. TrustWave) to scan the server and site.
- The ASV runs an automated scan that finds a bunch of random "vulns" such as old versions of software or the ability to list directories. The better ones actually scan the site for XSS and other web vulns.
- The client sends me a PDF depicting all the vulns.
- I lock down the server & report all the backports.
- The ASV runs the scanner again and signs off on it.
The way I see PCI is a "Cover Your Ass" type of thing. An authorized ASV signs off saying the site is "secure" thus deflecting some responsibility off the client.
With that being said, how does HIPAA compliance work? Let's say Joe the doctor came to me and said "Make my office HIPAA compliant." I know security but where would I start from the legal sense? Are there any "Authorized" HIPAA organizations that do scans and sign off that the organization is secure? Are there any hard coded rules (i.e. passwords must expire BEFORE n days)? Could I even help Joe out or must I be certified in some way?
Please briefly explain HIPAA compliance in the practical sense.
I am not doing anything for a client, I am just curious since this topic is very ambiguous and I have no experience in it.