I am hosting with a HIPAA compliant hosting company, as we are required to do because of the industry I am in. We have a BAA executed with them, and their responsibility terminates at the application level, meaning they are responsible for maintenance of the operating system. Therefore, they have access to the operating system and system files. We utilize SSL encryption for data in motion through our web server. The hosting provider has access to the operating system, thus they have access to the private key for SSL encryption and decryption.
My question is this: In theory, isn't it possible for a rogue employee at the hosting company to use the private key to decrypt the data in motion? This seems to be a hole in our security policy, but I must not be the only one to encounter this. For instance, Box.net must have the same issue because when you upload to Box, the data is encrypted over SSL, but the certificate is managed by Box. Therefore, they have access to your data. I welcome your thoughts and suggestions on this. Thanks.