Can you create a HIPAA compliant Amazon S3 Web Application?

Question

I am facing some questions when trying to design an S3 application using ASP.NET MVC and trying to stay HIPAA compliant.

My initial plan was to require an SSL connection to my web server, encrypt the images on my server, then send them to s3 using my private keys.

Here's my obvious concerns:

1. You cannot store unencrypted images in any temporary file cache when client views images within the browser.
2. Even if I setup an ashx to generically handle the image in memory, couldn't this get stored in cache?

Saying the images will be encrypted because you will be connecting to my server via https still does not guarantee all browsers will not cache data.

It's not possible to even consider the "Query String" with expiration option since data will be encrypted before being stored on disk at s3, and will again be decrypted at my server in memory.

I think my only option would be to write/purchase some sort of ActiveX component that will not expose the image as a simple html image source or write my app as a client side WinForm application.

Answer 1

On the face of it, it seems unlikely that cloud computing could be HIPAA compliant. Surely it is impossible to satisfy the Security Rule when the instance is hosted on someone else's hardware, tended by someone else's sysadmins?

However, Amazon have published a whitepaper on this very topic: Creating HIPAA-compliant Medical Data Applications with AWS. It is well-worth reading, and seems to address the main concerns. It does end with a disclaimer:

"This white paper is not intended to constitute legal advice. You are advised to seek the advice of counsel regarding compliance with HIPAA and other laws that may be applicable to you and your business."

Naturally the same applies to any advice you get from some random bloke off Das Interwebs.

Answer 2

Contrary to some of the other answers, cloud computing and cloud data storage can in fact be HIPAA compliant (note that they were written in 2010, when this was a much tougher call).

There are two main things you should consider for this:

1. you must get the cloud provider to sign a HIPAA Business Associate Agreement (BAA)
2. you must adhere closely to the Security Rule in the development of your system (encryption, audit trails, etc.)

Here are some cloud providers that will sign BAA's:

1. Amazon Web Services
2. Rackspace
3. Windows Azure (as of July 2012)

(Up until recently, Amazon wasn't willing to sign a BAA, so even though they had a whitepaper on compliance, following their guidelines just didn't cut it - all that has changed, though).

For image storage, AWS has S3 and Azure has blob storage.

As far as your concerns about serving the images in the browser, I'm actually not sure how strict you have to be, but it seems like you could embed your images within:

1. a Java Virtual Machine (JVM)
2. Flash
3. Flex
4. HTML5

It looks like PracticeFusion started off using Flex & Flash and is in the process of gradually transitioning to HTML5.