Aptible + TelePharm: HIPAA for Startups

Scott Ward (AWS), Frank Macreery (Aptible), Kent Safranski (TelePharm), and Caleb Boyd (TelePharm) discuss how to build compliant applications and architectures on top of AWS and Aptible.

Transcript

1. Aptible + Telepharm HIPAA for Startups Presenters: Scott Ward, AWS Frank Macreery, Aptible Caleb Boyd, Telepharm Kent Safranski, Telepharm June 23rd, 2015
2. AWS Compliance AWS maintains a formal control environment SOC 1 Type II report published every six months SOC 2 Security and Availability report every six months ISO 27001 Certification ISO 9001 Certification + Many more Certified PCI DSS 3.0 Level 1 Service Provider FedRAMP Certification HIPAA BAAs DoD CSM Levels 1-2, 3-5 GxP ISO 13485 AS9100 ISO/TS 16949
3. HIPAA Compliance HIPAA is there to protect the security and privacy of Protected Health Information (PHI). PHI covers a wide set of personally identifiable health and health related data. HIPAA on AWS means that you are protecting all the PHI data and that you are only using AWS services which are covered by the BAA allowing you to protect PHI information.
4. AWS looks after the security of the platform Customers are responsible for their security configuration IN the Cloud Security is shared between AWS and customers AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Encryption Key Management Client and Server Encryption Network Traffic Protection Platform, Applications, Identity & Access Management Operating System, Network & Firewall Configuration Customer content Customers
5. AWS HIPAA Eligible Services Customer may use all services within a “HIPAA Account” Customers may process, store, or transmit ePHI using only Eligible Services Amazon EC2 Elastic Load Balancing (TCP mode only) Amazon S3 Amazon EBS Amazon Glacier Amazon Redshift
6. AWS HIPAA configuration requirements Customers must encrypt ePHI in transit and at rest Customers must use EC2 Dedicated Instances for instances processing, storing, or transmitting ePHI Customers must record and retain activity related to use of and access to ePHI
7. Data Encryption at Rest Amazon Simple Storage Service (S3) Access controls at bucket and object level Restrict access and rights Versioning S3 Cryptographic Features HTTPS for in transit data S3 Server Side Encryption S3 Client Side Encryption MD5 Checksums to verify file integrity Amazon Elastic Block Store (EBS) Implement AWS managed encryption Implement your own encryption AWS Partner solutions to help with encryption management and implementation EBS
8. Data Encryption in Transit AWS Service endpoints support https Customers implement their own https or TLS encryption of data in transit to support their applications
9. Controlling your EC2 instances Launch instance EC2 AMI catalogue Running instance Your instance You choose and control your image AWS Catalog Your own Marketplace Community You determine network placement VPC Subnet Security Groups Public IP address You configure your instance Harden operating system Host based firewall Control admin/user access Logging Configure instance
10. Dedicated EC2 Instances Shared Tenancy Dedicated Tenancy EC2 instance customer #1 EC2 instance customer #2 EC2 instance customer #3 EC2 instance customer #4 EC2 instance customer #1 EC2 instance customer #1 EC2 instance customer #1 EC2 instance customer #1
11. Audit Controls - AWS CLOUDTRAIL You are making API calls... On a growing set of services around the world… AWS CloudTrail is continuously recording API calls… And delivering log files to you Redshift AWS CloudFormation AWS Elastic Beanstalk
16. Implementing Security Delegate, automate, standardize
17. What Does HIPAA Require?
18. Physical Safeguards
19. Physical Safeguards Facility Management
20. Physical Safeguards Physical Contingency Plans
21. Physical Safeguards
22. General Technical Safeguards
23. General Technical Safeguards Encryption
24. General Technical Safeguards Data Backups
25. General Technical Safeguards Instance Access (SSH) Controls
26. General Technical Safeguards
27. Specific Technical Safeguards
28. Specific Technical Safeguards Authentication
29. Specific Technical Safeguards PHI Record Access Controls (Authorization)
30. Specific Technical Safeguards
31. Administrative Safeguards
32. Administrative Safeguards Policies & Procedures
33. Administrative Safeguards Risk Assessments
34. Administrative Safeguards Workforce Training
35. Administrative Safeguards
36. Specific Technical General Technical Physical
37. Delegation
38. Delegation Aptible delegates physical safeguards to AWS
39. Delegation Customers delegate administrative and (many) technical safeguards to Aptible
40. How does Aptible implement technical safeguards?
41. OpsWorks Chef CloudTrail CFN
42. OpsWorks Chef CFN General Technical Safeguards Specific Technical Safeguards
43. Unique SSH User Identification OpsWorks + IAM
44. A covered entity must… assign a unique name and/or number for identifying and tracking user identity. §164.312(a)(2)(i) (Required)
45. Unique SSH User Identification OpsWorks + IAM
46. Unique SSH User Identification EC2 SSH key pair?
47. Unique SSH User Identification EC2 SSH key pair
48. Unique SSH User Identification Manual authorized_keys management?
49. Unique SSH User Identification Manual authorized_keys management
50. OpsWorks + IAM
51. IAM Identity and Access Management: Service for programmatically managing user identities
53. OpsWorks Chef-based deployment platform
54. OpsWorks + IAM Gives visibility into current SSH permissions across all EC2 instances
56. OpsWorks + IAM Makes it easy to rotate keys or revoke access
57. OpsWorks + IAM Creates an audit log of all SSH permission changes, through CloudTrail
58. End-to-end Encryption ELB—NGiNX—applications
59. A covered entity must… implement a mechanism to encrypt electronic protected health information whenever deemed appropriate. §164.312(a)(2)(i) (Addressable)
60. AWS "Approved" Services
61. AWS "Approved" Services EC2 ELB EBS S3 Glacier Redshift
62. EC2 Must use dedicated instances for PHI
63. EBS All PHI volumes must be encrypted
64. ELB End-to-end encryption in transit
66. TCP OR HTTPS TCP OR HTTPS HTTPS HTTPS
67. https://github.com/aptible/docker-nginx https://quay.io/repository/aptible/nginx
68. Standardized SSL Termination Container Deployed everywhere we require encryption in transit
69. Configurable via ENV $UPSTREAM_SERVERS
70. Configurable via ENV $UPSTREAM_SERVERS $FORCE_SSL $HSTS_MAX_AGE (…)
71. Configurable via ENV Makes testing easier
72. @test "It should send a Strict-Transport-Security header with FORCE_SSL" { FORCE_SSL=true wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
73. @test "It should send a Strict-Transport-Security header with FORCE_SSL" { FORCE_SSL=true wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
74. Configurable via ENV Abstracts implementation details: could be NGiNX, HAProxy, …
75. ENV configuration Simplifies configuration management: central store doesn’t need to know parameters in advance
76. Implementing Security Delegate low-level or general security details to providers like AWS and Aptible
77. Implementing Security Automate management of technical safeguards (e.g., through OpsWorks + IAM for SSH access)
78. Implementing Security Standardize implementation and deployment of key security infrastructure
79. Photo Documentation What is TelePharm? Remote Approval Hardware Agnostic Minimize Pharmacist Time Multi-Site Workflow Management
80. Why Aptible Market Options (VPS v. PaaS) Cost (Initial and Ongoing) Resource Requirements Uptime and Stability
81. Requirements and Challenges Minimize resource investment Scaling *Access Control *Auditing *Data storage *Real-time Data processing *Requires HIPAA Compliance
82. Access Control Scoped by Tenant/Organization Role based Limited session length Blacklist Detailed access logs
83. Auditing Log usage of DALs with current Principal Log usage of endpoints and services Store actions taken on ePHI
84. Data storage and processing Managed encryption on document storage Managed encryption on blob storage Managed encryption on (maybe) persistent cache storage • All solved with platform and infrastructure provided by AWS and Aptible.
85. Thank you