In the medical/pharmaceutical space as part of legal operating requirements, everyone has to comply with HIPAA standards ( http://health.state.tn.us/hipaa/ ) for moving personal medical information around. This means that, for example, you'd have to encrypt any email communication sent out with identifiable personal information.
Suppose Company X has created a doctor-facing suite of apps which has been locked down on a specially-provided tablet with MAAS360. The apps themselves go through a web portal which is also readily accessible online but not publicly advertised. If the web portal is not https:// secured, my concern is that this suite may not be complying with HIPAA in protecting patient data when doctors use it.
My questions are:
- If a system is not using https but is using some sort of non-https encryption later in the process, is that still secure? (my guess is no?)
- ... is that secure enough for HIPAA?
- ... are HIPAA security requirements reasonable requirements, or are they bureaucratic nonsense intended to give the illusion of security?