HIPAA Compliance

HIPAA Compliance Requirements

The following features need to be implemented before this system is HIPAA compliant. Some of these may be implemented already, I just haven't found it yet.

Security Rule §164.306 and Privacy Rule §164.530(c)

Logging required:

• Account Management – Success/Failure
• Directory Service Access - Success/Failure
• System Events - Success/Failure
• Object Access Attempts – Success/Failure
• Object Deletions
• Group Management
• Password Reset Attempts by Users
• Password Reset Attempts by Administrators or Account Operators
• Computer Account Management
• Directory Service Access Attempts
• Logon Failures – Active Directory
• Logon Failures – Local Logons

Data protection/Integrity

• It would be nice to mark a field as ePHI, then provide seamless at-rest encryption. This will allow users to not have to encrypt the drive that the database is on (allowing for SaaS).
• Force HTTPS?
• Cannot send emails containing ePHI
• Versioning on ePHI (addressable)

Access Control §164.312(a)(2)(iii)

• Enforcement of strong passwords is a requirement
• Expiring passwords
• Session expire time
• Pass reset key expire time