We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images.

What is required to become HIPAA Compliant?

-- Edit 2014-02-17 --

I just want to know where to start

closed as too broad by TildalWave, Adi, Xander, Steve, user10211 Feb 17 '14 at 9:57

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • HIPAA and similar regulations are not a simple checkbox where you can just do specific things and say you're HIPAA compliant, it typically requires audits, documentation, procedures, policies and a host of other hoops to jump through. Start with a consultant who specializes in HIPAA in your field. If you can't afford one, then I would suggest that you're not prepared for the costly regulatory quagmire you are about to embark upon in the first place. – Erik Funkenbusch Jan 11 '15 at 2:24

You need to start with understanding your obligations under HIPAA and HITECH. After that, you can read Windows Azure HIPAA Implementation Guidance. You should also refer to 19006 Federal Register /Vol. 74, No. 79, Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals for Purposes of the Breach Notification Requirements Under Section 13402 of Title XIII (Health Information Technology for Economic and Clinical Health Act) of the American Recovery and Reinvestment Act of 2009; Request for Information , which delineates certain other documents that pertain.

FIPS 140-2 Annex A algorithms (exclusively - 3-key TripleDES, AES (any length), SHA-1 and SHA-2 (any length), and RSA only, unless you really like Skipjack) are a bare minimum. NIST SP 800-131A offers additional guidance (which boils down to: no more SHA-1, no more RSA less than 2048 bits, no more DSA with a |p| less than 2048 bits or a |q| less than 224 bits).

You should also find a consultant who is an expert in both HIPAA and HITECH, as well as whatever other regulations cover what you're doing. Highly regulated areas like PHI storage are not places to wander into lightly or blindly.

Not the answer you're looking for? Browse other questions tagged or ask your own question.