Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Architecting Applications for HIPAA Compliance
Search
Frank Macreery
May 21, 2015
Technology
0
200
Architecting Applications for HIPAA Compliance
Originally presented at "Cloud Computing & Healthcare with AWS."
Frank Macreery
May 21, 2015
Tweet
Share
More Decks by Frank Macreery
See All by Frank Macreery
Docker for Ruby Developers
fancyremarker
3
650
Aptible + TelePharm: HIPAA for Startups
fancyremarker
0
1.4k
Containerization and Compliance
fancyremarker
0
550
HIPAA Dev Ops: Architecting Layers of Responsibility
fancyremarker
0
72
Garner: Anatomy of a Ruby Gem
fancyremarker
0
340
Other Decks in Technology
See All in Technology
Reach American Airlines®️ Instantly: 19 Calling Methods for Fast Support in the USA
flyamerican
1
170
使いたいMCPサーバーはWeb APIをラップして自分で作る #QiitaBash
bengo4com
0
1.9k
整頓のジレンマとの戦い〜Tidy First?で振り返る事業とキャリアの歩み〜/Fighting the tidiness dilemma〜Business and Career Milestones Reflected on in Tidy First?〜
bitkey
2
16k
事業成長の裏側:エンジニア組織と開発生産性の進化 / 20250703 Rinto Ikenoue
shift_evolve
PRO
2
21k
さくらのIaaS基盤のモニタリングとOpenTelemetry/OSC Hokkaido 2025
fujiwara3
3
440
LangSmith×Webhook連携で実現するプロンプトドリブンCI/CD
sergicalsix
1
230
KubeCon + CloudNativeCon Japan 2025 Recap by CA
ponkio_o
PRO
0
300
KubeCon + CloudNativeCon Japan 2025 Recap
ren510dev
1
380
Delegating the chores of authenticating users to Keycloak
ahus1
0
140
敢えて生成AIを使わないマネジメント業務
kzkmaeda
2
440
United Airlines Customer Service– Call 1-833-341-3142 Now!
airhelp
0
170
高速なプロダクト開発を実現、創業期から掲げるエンタープライズアーキテクチャ
kawauso
2
9.2k
Featured
See All Featured
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
233
17k
4 Signs Your Business is Dying
shpigford
184
22k
Navigating Team Friction
lara
187
15k
Bash Introduction
62gerente
613
210k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
251
21k
Embracing the Ebb and Flow
colly
86
4.7k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
53
2.9k
Art, The Web, and Tiny UX
lynnandtonic
299
21k
Fantastic passwords and where to find them - at NoRuKo
philnash
51
3.3k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
130
19k
Producing Creativity
orderedlist
PRO
346
40k
The World Runs on Bad Software
bkeepers
PRO
69
11k
Transcript
Architecting Applications for HIPAA Compliance Frank Macreery CTO, Aptible @fancyremarker
None
HIPAA The Health Insurance Portability and Accountability Act of 1996
HIPAA: What?
Protected Health Information (PHI)
Protected Health Information (PHI) "is created or received by a
health care provider or health plan…"
Protected Health Information (PHI) "relates to the health or condition
of an individual; the provision of health care to an individual; or the payment for the provision of health care to an individual…"
Protected Health Information (PHI) "identifies the individual"
HIPAA: Who?
Covered Entities Health plans, health care clearinghouses, health care providers
Business Associates An entity which "creates, receives, maintains, or transmits
protected health information"
None
None
None
None
Omnibus Final Rule Published January 2013 Effective Date: March 2013
Compliance Date: September 2013
HIPAA: Why?
Office of Civil Rights (OCR) The enforcement agency for HIPAA
14,300 Enforcement Cases in 2014
14,300 Enforcement Cases in 2014 Up 300% since 2004
14,300 Enforcement Cases in 2014 24% of cases resulted in
corrective action
$200 Direct breach response and remediation costs average $200/record
$1000 Damages sought in class action suits average $1000/record
$1.5 Million HHS can levy up to $1,500,000 in fines
for each provision violated
Implementing Security Delegate, automate, standardize
What Does HIPAA Require?
Physical Safeguards
Physical Safeguards Facility Management
Physical Safeguards Physical Contingency Plans
Physical Safeguards
General Technical Safeguards
General Technical Safeguards Encryption
General Technical Safeguards Data Backups
General Technical Safeguards Instance Access (SSH) Controls
General Technical Safeguards
Specific Technical Safeguards
Specific Technical Safeguards Authentication
Specific Technical Safeguards PHI Record Access Controls (Authorization)
Specific Technical Safeguards
Administrative Safeguards
Administrative Safeguards Policies & Procedures
Administrative Safeguards Risk Assessments
Administrative Safeguards Workforce Training
Administrative Safeguards
Physical General Technical Specific Technical
Delegation
Delegation Aptible delegates physical safeguards to AWS
Delegation Customers delegate administrative and (many) technical safeguards to Aptible
How does Aptible implement technical safeguards?
OpsWorks Chef CloudTrail CFN
OpsWorks Chef CFN General Technical Safeguards Specific Technical Safeguards
Unique SSH User Identification OpsWorks + IAM
§164.312(a)(2)(i) (Required) "A covered entity must… assign a unique name
and/or number for identifying and tracking user identity."
Unique SSH User Identification OpsWorks + IAM
Unique SSH User Identification EC2 SSH key pair?
Unique SSH User Identification EC2 SSH key pair
Unique SSH User Identification Manual authorized_keys management?
Unique SSH User Identification Manual authorized_keys management
OpsWorks + IAM
IAM Identity and Access Management: Service for programmatically managing user
identities
None
OpsWorks Chef-based deployment platform
OpsWorks + IAM Gives visibility into current SSH permissions across
all EC2 instances
None
OpsWorks + IAM Makes it easy to rotate keys or
revoke access
OpsWorks + IAM Creates an audit log of all SSH
permission changes, through CloudTrail
End-to-end Encryption ELB—NGiNX—applications
§164.312(a)(2)(i) (Addressable) "A covered entity must… implement a mechanism to
encrypt electronic protected health information whenever deemed appropriate"
AWS "Approved" Services
AWS "Approved" Services EC2 ELB EBS S3 Glacier Redshift
EC2 Must use dedicated instances for PHI
EBS All PHI volumes must be encrypted
ELB End-to-end encryption in transit
None
TCP OR HTTPS HTTP HTTP TCP OR HTTPS
https://github.com/aptible/docker-nginx https://quay.io/repository/aptible/nginx
Standardized SSL Termination Container Deployed everywhere we require encryption in
transit
Configurable via ENV $UPSTREAM_SERVERS
Configurable via ENV $UPSTREAM_SERVERS $FORCE_SSL $HSTS_MAX_AGE (…)
Configurable via ENV Makes testing easier
@test "It should send a Strict-Transport-Security header with FORCE_SSL" FORCE_SSL=true
wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
@test "It should send a Strict-Transport-Security header with FORCE_SSL" FORCE_SSL=true
wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
Configurable via ENV Abstracts implementation details: could be NGiNX, HAProxy,
…
ENV configuration Simplifies configuration management: central store doesn’t need to
know parameters in advance
Auditing Implementation is not enough
Auditing means… Logging SSH access to instances
OpsWorks + IAM
OpsWorks + IAM Creates an audit log of all SSH
permission changes, through CloudTrail
OpsWorks + IAM Works for new authorizations, but how can
we log individual SSH sessions?
Deny by Default
https://github.com/aptible/opsworks-cli
Deny by Default Periodically disable all SSH permissions: opsworks iam:lockdown
--stack foobar
Deny by Default SSH permissions last only one hour, and
must be renewed opsworks iam:allow alice --stack foobar
Deny by Default Every SSH session gets logged to CloudTrail
(with 1 hour granularity)
Auditing means… Documenting a mitigation for every vulnerability
Heartbleed
Heartbleed POODLEbleed
Heartbleed POODLEbleed xBleed???
How do we prove that PHI was unaffected by xBleed?
Integration Tests Document every security response
https://github.com/sstephenson/bats
# Dockerfile # Install and configure NGiNX... # ... ADD
test /tmp/test RUN bats /tmp/test https://github.com/aptible/docker-nginx Image: quay.io/aptible/nginx
#!/usr/bin/env bats # /tmp/test/nginx.bats @test "It should pass an external
Heartbleed test" { install_heartbleed wait_for_nginx Heartbleed localhost:443 uninstall_heartbleed }
#!/usr/bin/env bats # /tmp/test/nginx.bats @test "It should pass an external
Heartbleed test" { install_heartbleed wait_for_nginx Heartbleed localhost:443 uninstall_heartbleed }
@test "It should pass an external Heartbleed test" { #
... install_heartbleed # ... } install_heartbleed() { export GOPATH=/tmp/gocode export PATH=${PATH}:/usr/local/go/bin:${GOPATH}/bin go get github.com/FiloSottile/Heartbleed go install github.com/FiloSottile/Heartbleed }
@test "Its OpenSSL client should support TLS_FALLBACK_SCSV" { FORCE_SSL=true wait_for_nginx
run local_s_client -fallback_scsv [ "$status" -eq "0" ] } @test "It should support TLS_FALLBACK_SCSV by default" { FORCE_SSL=true wait_for_nginx run local_s_client -fallback_scsv -no_tls1_2 [ "$status" -ne "0" ] [[ "$output" =~ "inappropriate fallback" ]] }
Integration tests happen during each image build
Integration tests happen during each image build Images are built
and tests run automatically
None
Integration tests happen during each image build Security test status
is easy to verify at a glance
None
HIPAA Regulates PHI, and any vendor handling PHI needs to
comply
Implementing Security Delegate low-level or general security details to providers
like AWS and Aptible
Implementing Security Automate management of technical safeguards (e.g., through OpsWorks
+ IAM for SSH access)
Implementing Security Standardize implementation and deployment of key security infrastructure
Auditing Use AWS services (OpsWorks, CloudTrail, etc.) to automate PHI
access logging
Auditing Audit all PHI access and document all responses to
security incidents
Thank you
@fancyremarker
[email protected]