We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) data.

I would like to know if HIPAA recommends in isolating database per client(Provider/Practice) - ie is a single database for every client a security breach of HIPAA rules and regulations?

  • Are you hosting and controlling everything or using a third party provider for hosting?
    – Eric G
    Apr 3, 2014 at 19:53
  • We own a datacenter. Most probably we will be hosting the same in our premise. If it is not feasible we will look into AWS or Firehost.
    – Arun Kumar
    Apr 12, 2014 at 8:33

1 Answer 1


HIPAA doesn't specifically prohibit shared infrastructure.

If you are going to be a neutral firm offering SaaS to numerous practices, this architecture will be fine. Ensure that your logical security is top notch such that no client can access data for any other client. This is fairly easy, but needs to be a deliberate, documented and demonstrable process. Ensure automated testing is in place to enforce these audits, heavily test your data access layer, etc.

Also, ensure your storage is encrypted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.