WIXLIB

ACHIEVING HIPAACOMPLIANCE WITHPOSTGRES PLUSCLOUD DATABASE

TABLE OF CONTENTS03INTRODUCTION04FUNDAMENTALS OF HIPAA AND HITECH04HIPAA-COMPLIANT DATA MANAGEMENT IN THE CLOUD05POSTGRES PLUS CLOUD DATABASE08SUMMARY2 2015 EnterpriseDB Corporation. All rights reserved.

INTRODUCTIONThe health care industry is in the midst of a massivetransformation aimed at improving patient care and reducingcosts. In the U.S., the Affordable Care Act, in concert withregulations such as HIPAA and HITECH, are accelerating thetransition to automated processes. Over 80 countries andunions across Europe, Asia, Africa and North America haveadopted data privacy and protection laws similar to those inthe U.S. However, the information that drives these processes– patient records, clinical test results, medical images,claims data – is highly sensitive. Healthcare and life sciencestakeholders, therefore, must automate internal and crossorganization workflows while maintaining patient privacy andprotecting intellectual property.HEALTH CARE DATA AT RISKRESEARCH REVEALS THATDATA BREACHES COST THEHEALTH CARE INDUSTRYABOUT 5.6B/YR1. ANOTHERSTUDY PREDICTS “THEHEALTHCARE INDUSTRY,BY FAR, WILL BE THEMOST SUSCEPTIBLE TOPUBLICLY DISCLOSED ANDWIDELY SCRUTINIZED DATABREACHES”2.3The HIPAA Final Omnibus Rule, published in January, 2013,mandates that any person or organization which “creates,receives, maintains or transmits” electronic protected healthinformation (PHI) must comply with the HIPAA Security Rule.From a computing perspective, the Final Omnibus Ruleeffectively requires cloud service providers to share legalresponsibility for the privacy of electronically-transmitted PHI.In the presence of broad health care privacy statutes,organizations are challenged to leverage the economic andscaling benefits of cloud computing while complying withmulti-level privacy requirements. EnterpriseDB’s PostgresPlus Cloud Database (PPCD), in combination with popularcloud platforms such as Amazon Web Services (AWS), offersa secure, scalable database foundation for a wide range ofhealth care applications.This paper explores PPCD’s advanced security and auditingfeatures. Our goal is to clarify cloud data management andauditing requirements in the context of HIPAA, and discusshow PPCD meets those requirements when deployed on anAWS infrastructure. 2015 EnterpriseDB Corporation. All rights reserved.

FUNDAMENTALS OF HIPAA AND HITECHThe Health Insurance Portability and Accountability Act(HIPAA) was passed in 1996. Along with increasing the useof electronic medical records, the law included provisionsto protect the security and privacy of Protected HealthInformation (PHI). PHI includes a wide set of personallyidentifiable health- and health-related data, from insuranceand billing information, to diagnosis data, clinical care data,and lab results such as images and test results.HIPAA was expanded by the Health Information Technologyfor Economic and Clinical Health Act (HITECH) in 2009.HIPAA and HITECH establish a set of federal standardsintended to protect the security and privacy of PHI, andimpose requirements related to the use and disclosure of PHI,appropriate safeguards to protect PHI, individual rights, andadministrative responsibilities. For the purposes of this paper,we’ll refer to HIPAA and HITECH collectively as “HIPAA”.Among its extensive regulatory provisions,HIPAA defines two primary stakeholders: Covered Entities – including hospitals, medical servicesproviders, employer sponsored health plans, researchfacilities and insurance companies Business Associates – a person or entity performingactivities on behalf of, or providing certain services to, acovered entity while not employed by the covered entity.The HIPAA Final Omnibus Rule clarifies that any companymaintaining PHI on behalf of a covered entity is considereda business associate. Cloud service providers such as AWSare considered HIPAA business associates. Thus, AWS mustenter into a business associate agreement with any coveredentity on behalf of which AWS stores and transmits PHI.HIPAA-COMPLIANT DATA MANAGEMENTIN THE CLOUDHIPAA Security Rule ComplianceTo safeguard PHI adequately,organizations must provide arange of operational, technicaland environmental controls.Organizations must createcompliant business processes;database systems must providesecurity and auditability; and cloudservice providers must deliversecure, controllable executionenvironments.4ADMINISTRATIVESAFEGAURDS Policies and processes Security awareness and training User access controls Business Associate agreementsPHYSICALSAFEGUARDS User access controls Physical storage controls Environment audit logs Workplace security controlsTECHNICALSAFEGUARDS User access controls Data transmission security Data storage security Audit logs and systems monitoring 2015 EnterpriseDB Corporation. All rights reserved.

As part of its HIPAA business associateagreement, Amazon defines a twopart “shared responsibility model” forimplementing secure, compliant cloudenvironments: Health care organizations that have business associateagreements with AWS use the cloud services available inspecially-designated HIPAA accounts, ensuring that thoseservices are aligned with HIPAA’s security rules (i.e., bysupporting the guidelines defined in NIST 800-66). Moreinformation about AWS HIPAA compliance is available here.Security measures that AWS implements and operates –“security of the cloud”.Security measures that a covered entity implements andoperates that relate to content and applications that useAWS services – “security in the cloud”.POSTGRES PLUS CLOUD DATABASEWhile AWS provides a HIPAA-compliant cloud platform,health care applications also require a database managementfoundation for processing transactions, storing structuredand unstructured information, and supporting a varietyof reporting/analytical requirements. To safeguard PHIadequately, the database manager must complementthe capabilities of the platform (AWS, in this case) with acomprehensive suite of security and auditing features.PPCD is an enterprise class database solution that powerssome of the world’s most demanding applications. PPCDincludes a rich set of database features, elastically scalableperformance and built-in high availability – all accessible froman integrated management dashboard.PPCD deploys on AWS EC2 to deliver a secure, compliantdata management foundation for a wide range of healthcare applications. EC2 provides a secure cloud operatingenvironment within which PPCD provides additional PHIsecurity, transaction processing, auditing and databasefault tolerance.Among PPCD’s many enterprise features that relate to security-sensitive health careapplications include:5PRIVATE INSTANCESWITH CLOSED PORTSAll PPCD databases are deployed using private AWS instances.AT-REST DATAENCRYPTIONPPCD uses AES 512 bit cryptography to protect stored data.AES is among the strongest ciphers available in moderncomputing, and is the cipher standard recommended by NIST.IN-TRANSIT DATAENCRYPTIONPPCD generates SSL certificates for every database. Client-sidecertificates can be generated based on the database certificatesand used in client applications. 2015 EnterpriseDB Corporation. All rights reserved.

PASSWORD STORAGEENCRYPTIONBy default, database user passwords are stored as MD5 hashes, soadministrators cannot determine user passwords. If MD5 encryptionis used for client authentication, the unencrypted password is neverpresent on the server.CLIENT-SIDEENCRYPTIONFor applications that process highly sensitive data requiring anextra level of security, data can be encrypted and decrypted by theclient. Thus, unencrypted data never appears in the database.ROW-LEVEL SECURITYAllows an application to authenticate users and set the context forwhich rows in the database become visible to specific user sessions.SQL INJECTIONPROTECTIONScreens incoming queries for common SQL injection profiles.In addition, PPCD can be configured to accept known queriesand reject unfamiliar data request patterns.DATABASE AUDITINGAllows security administrators and auditors to track and analyze avariety of activities including database access, usage, creation,change and deletion. Audit reports can be viewed using PPCD’s DBAManagement Server.PPCD runs as a databasecluster on private AWS instances,ensuring that all PHI remainsunder complete control at alltimes. The master database, allreplica instances, and Amazonstorage for the database aremanaged resources of the AWSHIPAA account.AUTOMATICALLY CREATEDGUI Cloud ConsoleClient Apps/UsersConnection Pooler& Load BalancerReadsWritesMasterServerCluster ManagerAuto-provisioning,Health Check, Auto Fallover,Scaling, BackupAdmin Appor TerminalStreamingReplicationCloud ResourcesNetwork, Elastic IP,Elastic Storage, VMs,Security, Hardware6 2015 EnterpriseDB Corporation. All rights reserved.ReplicaServersAutoElasticScale-Out

Each database cluster includes a load balancer,whichreceives incoming requests from applications and distributesread requests across all read-only replicas within the cluster(unless there are no replicas, in which case the masterhandles all requests). Write requests are passed directly tothe master database. Applications connect to PPCD databases though definedports using chosen encryption options. All IDE anddevelopment tools can connect to the database by using the address and port information provided when the cluster wascreated. A Logical Volume Manager (LVM) aggregates storagefor the cluster, allowing transparent scaling of cloud storagewithout adversely affecting running databases.In addition to the security and compliancerelated capabilities described above, PPCDprovides other powerful features that areoften critical to health care applications,including: ACID compliance – PPCD is a 100% ACID compliantrelational DBMS. Its proven, high performance transactionengine powers many of the world’s most advancedmission-critical applications. Rich data types – Postgres is renowned for supporting awide variety of structured, semi-structured andunstructured data. Unlike NoSQL datastores, whichoperate under eventual consistency semantics, all PPCDdata is managed transactionally to ensure it is consistentand accurate at all times. Using PPCD, applicationsleverage the simplicity and power of a single, flexible datamanagement infrastructure.7 Integration – PPCD’s foreign data wrappers (FDW) providea simple and powerful way to interoperate with externaldata sources. Health care application developersand DBAs can use FDWs to easily aggregate data fromcompanion systems to create a single, integrateddatabase. FDWs save significant time and costs forapplications requiring database interoperability.Portability – Postgres is available from multiple vendors– on-premise, in virtualized environments and in thecloud. Freedom of choice eliminates vendor lock-inand stimulates a vibrant, competitive market for Postgresproducts and services.Compatibility – PPCD delivers comprehensive Oracle compatibility, allowing health care organizations toleverage their Oracle database investments whiletransitioning to the cloud. Oracle DBAs and applicationdevelopers can use their existing skills, tools andpractices to implement new systems using PPCD. Inaddition, EnterpriseDB offers Oracle Migration Services toassist organizations to migrate existing Oracleapplications to PPCD. 2015 EnterpriseDB Corporation. All rights reserved.