Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Architecting Applications for HIPAA Compliance
Search
Frank Macreery
May 21, 2015
Technology
0
200
Architecting Applications for HIPAA Compliance
Originally presented at "Cloud Computing & Healthcare with AWS."
Frank Macreery
May 21, 2015
Tweet
Share
More Decks by Frank Macreery
See All by Frank Macreery
Docker for Ruby Developers
fancyremarker
3
650
Aptible + TelePharm: HIPAA for Startups
fancyremarker
0
1.4k
Containerization and Compliance
fancyremarker
0
550
HIPAA Dev Ops: Architecting Layers of Responsibility
fancyremarker
0
72
Garner: Anatomy of a Ruby Gem
fancyremarker
0
340
Other Decks in Technology
See All in Technology
ソフトウェアテストのAI活用_ver1.25
fumisuke
1
610
AI Ready API ─ AI時代に求められるAPI設計とは?/ AI-Ready API - Designing MCP and APIs in the AI Era
yokawasa
8
2.1k
サービスを止めるな! DDoS攻撃へのスマートな備えと最前線の事例
coconala_engineer
1
180
推し書籍📚 / Books and a QA Engineer
ak1210
0
140
cdk initで生成されるあのファイル達は何なのか/cdk-init-generated-files
tomoki10
1
670
Figma Dev Mode MCP Serverを用いたUI開発
zoothezoo
0
230
OpenTelemetryセマンティック規約の恩恵とMackerel APMにおける活用例 / SRE NEXT 2025
mackerelio
3
2k
Bill One 開発エンジニア 紹介資料
sansan33
PRO
4
13k
サイバーエージェントグループのSRE10年の歩みとAI時代の生存戦略
shotatsuge
4
1k
第64回コンピュータビジョン勉強会「The PanAf-FGBG Dataset: Understanding the Impact of Backgrounds in Wildlife Behaviour Recognition」
x_ttyszk
0
240
AWS 怖い話 WAF編 @fillz_noh #AWSStartup #AWSStartup_Kansai
fillznoh
0
130
「現場で活躍するAIエージェント」を実現するチームと開発プロセス
tkikuchi1002
3
350
Featured
See All Featured
Unsuck your backbone
ammeep
671
58k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.7k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
35
2.4k
How to Think Like a Performance Engineer
csswizardry
25
1.7k
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
tammyeverts
8
340
Into the Great Unknown - MozCon
thekraken
40
1.9k
Documentation Writing (for coders)
carmenintech
72
4.9k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
29
9.6k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
1.8k
Done Done
chrislema
184
16k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
15
1.6k
Transcript
Architecting Applications for HIPAA Compliance Frank Macreery CTO, Aptible @fancyremarker
None
HIPAA The Health Insurance Portability and Accountability Act of 1996
HIPAA: What?
Protected Health Information (PHI)
Protected Health Information (PHI) "is created or received by a
health care provider or health plan…"
Protected Health Information (PHI) "relates to the health or condition
of an individual; the provision of health care to an individual; or the payment for the provision of health care to an individual…"
Protected Health Information (PHI) "identifies the individual"
HIPAA: Who?
Covered Entities Health plans, health care clearinghouses, health care providers
Business Associates An entity which "creates, receives, maintains, or transmits
protected health information"
None
None
None
None
Omnibus Final Rule Published January 2013 Effective Date: March 2013
Compliance Date: September 2013
HIPAA: Why?
Office of Civil Rights (OCR) The enforcement agency for HIPAA
14,300 Enforcement Cases in 2014
14,300 Enforcement Cases in 2014 Up 300% since 2004
14,300 Enforcement Cases in 2014 24% of cases resulted in
corrective action
$200 Direct breach response and remediation costs average $200/record
$1000 Damages sought in class action suits average $1000/record
$1.5 Million HHS can levy up to $1,500,000 in fines
for each provision violated
Implementing Security Delegate, automate, standardize
What Does HIPAA Require?
Physical Safeguards
Physical Safeguards Facility Management
Physical Safeguards Physical Contingency Plans
Physical Safeguards
General Technical Safeguards
General Technical Safeguards Encryption
General Technical Safeguards Data Backups
General Technical Safeguards Instance Access (SSH) Controls
General Technical Safeguards
Specific Technical Safeguards
Specific Technical Safeguards Authentication
Specific Technical Safeguards PHI Record Access Controls (Authorization)
Specific Technical Safeguards
Administrative Safeguards
Administrative Safeguards Policies & Procedures
Administrative Safeguards Risk Assessments
Administrative Safeguards Workforce Training
Administrative Safeguards
Physical General Technical Specific Technical
Delegation
Delegation Aptible delegates physical safeguards to AWS
Delegation Customers delegate administrative and (many) technical safeguards to Aptible
How does Aptible implement technical safeguards?
OpsWorks Chef CloudTrail CFN
OpsWorks Chef CFN General Technical Safeguards Specific Technical Safeguards
Unique SSH User Identification OpsWorks + IAM
§164.312(a)(2)(i) (Required) "A covered entity must… assign a unique name
and/or number for identifying and tracking user identity."
Unique SSH User Identification OpsWorks + IAM
Unique SSH User Identification EC2 SSH key pair?
Unique SSH User Identification EC2 SSH key pair
Unique SSH User Identification Manual authorized_keys management?
Unique SSH User Identification Manual authorized_keys management
OpsWorks + IAM
IAM Identity and Access Management: Service for programmatically managing user
identities
None
OpsWorks Chef-based deployment platform
OpsWorks + IAM Gives visibility into current SSH permissions across
all EC2 instances
None
OpsWorks + IAM Makes it easy to rotate keys or
revoke access
OpsWorks + IAM Creates an audit log of all SSH
permission changes, through CloudTrail
End-to-end Encryption ELB—NGiNX—applications
§164.312(a)(2)(i) (Addressable) "A covered entity must… implement a mechanism to
encrypt electronic protected health information whenever deemed appropriate"
AWS "Approved" Services
AWS "Approved" Services EC2 ELB EBS S3 Glacier Redshift
EC2 Must use dedicated instances for PHI
EBS All PHI volumes must be encrypted
ELB End-to-end encryption in transit
None
TCP OR HTTPS HTTP HTTP TCP OR HTTPS
https://github.com/aptible/docker-nginx https://quay.io/repository/aptible/nginx
Standardized SSL Termination Container Deployed everywhere we require encryption in
transit
Configurable via ENV $UPSTREAM_SERVERS
Configurable via ENV $UPSTREAM_SERVERS $FORCE_SSL $HSTS_MAX_AGE (…)
Configurable via ENV Makes testing easier
@test "It should send a Strict-Transport-Security header with FORCE_SSL" FORCE_SSL=true
wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
@test "It should send a Strict-Transport-Security header with FORCE_SSL" FORCE_SSL=true
wait_for_nginx run curl -Ik https://localhost 2>/dev/null [[ "$output" =~ "Strict-Transport-Security: max-age=31536000" ]] }
Configurable via ENV Abstracts implementation details: could be NGiNX, HAProxy,
…
ENV configuration Simplifies configuration management: central store doesn’t need to
know parameters in advance
Auditing Implementation is not enough
Auditing means… Logging SSH access to instances
OpsWorks + IAM
OpsWorks + IAM Creates an audit log of all SSH
permission changes, through CloudTrail
OpsWorks + IAM Works for new authorizations, but how can
we log individual SSH sessions?
Deny by Default
https://github.com/aptible/opsworks-cli
Deny by Default Periodically disable all SSH permissions: opsworks iam:lockdown
--stack foobar
Deny by Default SSH permissions last only one hour, and
must be renewed opsworks iam:allow alice --stack foobar
Deny by Default Every SSH session gets logged to CloudTrail
(with 1 hour granularity)
Auditing means… Documenting a mitigation for every vulnerability
Heartbleed
Heartbleed POODLEbleed
Heartbleed POODLEbleed xBleed???
How do we prove that PHI was unaffected by xBleed?
Integration Tests Document every security response
https://github.com/sstephenson/bats
# Dockerfile # Install and configure NGiNX... # ... ADD
test /tmp/test RUN bats /tmp/test https://github.com/aptible/docker-nginx Image: quay.io/aptible/nginx
#!/usr/bin/env bats # /tmp/test/nginx.bats @test "It should pass an external
Heartbleed test" { install_heartbleed wait_for_nginx Heartbleed localhost:443 uninstall_heartbleed }
#!/usr/bin/env bats # /tmp/test/nginx.bats @test "It should pass an external
Heartbleed test" { install_heartbleed wait_for_nginx Heartbleed localhost:443 uninstall_heartbleed }
@test "It should pass an external Heartbleed test" { #
... install_heartbleed # ... } install_heartbleed() { export GOPATH=/tmp/gocode export PATH=${PATH}:/usr/local/go/bin:${GOPATH}/bin go get github.com/FiloSottile/Heartbleed go install github.com/FiloSottile/Heartbleed }
@test "Its OpenSSL client should support TLS_FALLBACK_SCSV" { FORCE_SSL=true wait_for_nginx
run local_s_client -fallback_scsv [ "$status" -eq "0" ] } @test "It should support TLS_FALLBACK_SCSV by default" { FORCE_SSL=true wait_for_nginx run local_s_client -fallback_scsv -no_tls1_2 [ "$status" -ne "0" ] [[ "$output" =~ "inappropriate fallback" ]] }
Integration tests happen during each image build
Integration tests happen during each image build Images are built
and tests run automatically
None
Integration tests happen during each image build Security test status
is easy to verify at a glance
None
HIPAA Regulates PHI, and any vendor handling PHI needs to
comply
Implementing Security Delegate low-level or general security details to providers
like AWS and Aptible
Implementing Security Automate management of technical safeguards (e.g., through OpsWorks
+ IAM for SSH access)
Implementing Security Standardize implementation and deployment of key security infrastructure
Auditing Use AWS services (OpsWorks, CloudTrail, etc.) to automate PHI
access logging
Auditing Audit all PHI access and document all responses to
security incidents
Thank you
@fancyremarker
[email protected]