I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would want to do is export the SQL DB on my local computer, use a passphrase in the Cloudberry config and the highest encryption settings, and upload to S3 nightly. This data will be at rest.
From what I read in the past this seems acceptable, and the statement below makes it sound acceptable as well but I want to be sure.
A PDF on the Cloudberry site states this:
Leveraging Amazon S3 as a HIPAA-compliant storage platform - The Amazon S3 platform offers a cost-efficient alternative to store your customers’ digital records. All incoming data is automatically duplicated across several distinct locations to provide high durability and availability of customer data. The implemented encryption algorithms protect the confidentiality of in-transit (inbound and outbound) and “at-rest” (resident) data as required by the HIPAA provision. The industry-grade authentication helps delegate specific access control permissions to different user and administrator accounts.
I've read about BAA (business associate agreements) and other things, which some people suggest, and some say is unneccessary. I figured it would just be best to ask the professionals - is this method of backing up HIPAA data to the cloud compliant?