Can someone please briefly explain HIPAA compliance?

Question

I worked in web hosting for several years, particularly security. I am familiar with PCI compliance and I would say the "short and sweet" guide to PCI for an eCommerce store is as follows:

1. Client goes to the bank and gets a merchant account.
2. Merchant tells the client to use some random "authorized scanning vendor" (ASV) (i.e. TrustWave) to scan the server and site.
3. The ASV runs an automated scan that finds a bunch of random "vulns" such as old versions of software or the ability to list directories. The better ones actually scan the site for XSS and other web vulns.
4. The client sends me a PDF depicting all the vulns.
5. I lock down the server & report all the backports.
6. The ASV runs the scanner again and signs off on it.
7. PROFIT!

The way I see PCI is a "Cover Your Ass" type of thing. An authorized ASV signs off saying the site is "secure" thus deflecting some responsibility off the client.

With that being said, how does HIPAA compliance work? Let's say Joe the doctor came to me and said "Make my office HIPAA compliant." I know security but where would I start from the legal sense? Are there any "Authorized" HIPAA organizations that do scans and sign off that the organization is secure? Are there any hard coded rules (i.e. passwords must expire BEFORE n days)? Could I even help Joe out or must I be certified in some way?

Please briefly explain HIPAA compliance in the practical sense.

I am not doing anything for a client, I am just curious since this topic is very ambiguous and I have no experience in it.

Answer 1

HIPAA compliance is a little more complicated. There are minimum security standards with regards to configuration in the network, systems and physical security domains which must be met before your organization may be certified "HIPAA Compliant". There are too many to list here, but to give you an idea, here's a few line items.

On the network side, such minimum security standards include:

• Separate VLAN for medical records / medical device traffic
• Access Control Lists with default-deny, restricting access to medical VLAN
• Default-deny access policies (users must be explicitly granted access)

On the systems side:

• Workstations auto-lock their screens after X minutes (usually <15)
• Users are required to change passwords every X days (usually 90)
• Granular permissions for network shares, with default-deny

On the physical side:

• Physical access to network/systems maintenance areas must be secured through lock & key at minimum, two-factor preferred
• Security cameras must monitor building entrances and server/network rooms

On the administrative side:

• Terminated employee credentials must be revoked same-day
• Employee background checks must be conducted, by a vetted agency

...and the list goes on-and-on. That's just the tip of the iceberg.

Generally, the network/systems security requirements follow the NIST SCAP guides: security checklists of "best practices", which may be found here:

NOTE: Large parts of these websites are unavailable during the government shutdown.

EDITed to add:

In a legal sense, you'll need to ensure that you follow all the guidelines. This is the "due diligence" for HIPAA compliance. See here

Note that if the Department of Health & Human Services audits you and finds security compliance issues, your organization may find itself on the wrong side of more than one regulatory body.

EDIT 2: Also note that "certification" by a third party does not absolve the business entity from any responsibility relating to HIPAA compliance.