If you have an idea for a healthcare app, but don't know how to build
in a HIPAA compliant way, then stick around.
I'm going to break down what HIPAA means to you when building in AWS.
First, a quick disclaimer, I am not a lawyer,
you should consult your legal advisors to understand how HIPAA
or related laws apply to you.
Today's episode topic comes from Pushkar.
Pushkar is an information analyst in the state of Virginia in the USA.
When he's not singing and playing his guitar, he's thinking about ways to use
technology to improve business processes.
Let's hear from Pushkar.
Hi, I'm Pushkar, and I'm looking to come up with a decentralized digital
vaccine record that enables our providers to capture an immutable
vaccination record for the patients.
The patient's themselves to augment the record with any side effects
their personal information and/or medical history.
A centralized agency to serve as a validator
or a custodian of the digital record.
Event organizers, cross border travel agencies, and the medical
researchers can use the record to validate vaccinations for patients,
study the side effects of the vaccine on patients, and different audiences.
All of this while maintaining the anonymity of the
person/patient's personal information.
The reason I chose blockchain was it provides a truly immutable record
minimizing fraud, while protecting the patient's personal information
in accordance with HIPAA rules.
That's everything I'm looking to get today.
Thanks.
Pushkar wants to make it easy for people to verify
the vaccines that they've received.
I'm going to use Pushkar's app as a healthy example to show what a
health care app in AWS looks like.
I know you've got this amazing idea for health care app.
And it's tempting to think, yeah, I just need to build it fast
and get customers and then I'll deal with this HIPAA jargon, slowdown friend,
you're going to have to think about HIPAA as you build from the ground up.
You can't just build your app at AWS and expect it to be HIPAA compliant.
You still have to take measures to assure you are adhering
to necessary security regulations.
At AWS, we refer to this as the shared responsibility model,
which is extremely important in health care.
I'll get into that more in a minute.
But first, let's break down what HIPAA actually is.
HIPAA is an acronym for Health Insurance, Portability and Accountability Act.
It's the United States legislation that imposes requirements related to the use,
and disclosure of protected health information, or PHI.
The goal of HIPAA is to protect the security and privacy of PHI.
One of the ways to do that, which I'll focus on is the idea
of the safeguards principle.
These safeguards can be thought of as controls that you put
in place to protect PHI data.
HIPAA defines PHI based on a set of 18 identifiers that may appear in
data such as name or email address.
This is the data that has to be protected.
Don't worry, I've dropped links in the description of this video
to HIPAA rules and what that means in AWS.
The shared responsibility model is extremely important in health care.
Shared responsibility outlines, who is responsible for implementing
those safeguards I spoke about.
When it comes to protecting PHI, there are five key categories that you've
got to be on top of to achieve and demonstrate HIPAA compliance in AWS.
They are one, a business associate agreement, also known as a BAA.
Two, only use HIPAA eligible services.
Three, always encrypt both in transit and at rest.
Four, audit everything, and five, demonstrate compliance.
A BAA is a legal document that outlines who is responsible when it comes to
ensuring the privacy of healthcare data.
Once the BAA is in place, it's time to build.
There are a lot of rules when it comes to health care and PHI.
You have to take these into consideration when designing and building.
AWS has HIPAA eligible services, which are AWS services that AWS has reviewed
and approved to host or process PHI.
All the services that I'm going to mention, are HIPAA eligible.
I've included a link that lists the AWS services that are HIPAA eligible.
It's important to know that HIPAA eligible does not mean HIPAA compliant.
Feel free to pause the video to let that sink in.
Don't worry, I'm not going anywhere.
Okay, now let's look at Pushkar's app to see what HIPAA means.
Every app needs secure user authentication, and authorization.
Amazon Cognito, lets you add user signup, sign in and access control to your web
and mobile apps, quickly and easily.
Pushkar needs to make sure that a user's vaccine history is accurate.
This is a good use case for a ledger database.
Amazon Quantum Ledger Database, also known as QLDB is a fully managed
ledger database that provides an immutable transaction log.
Pairing QLDB with AWS AppSync will allow Pushkar to safely expose
a user's vaccination history.
AppSync is a fully managed Graph QL service that can be used to create API's.
You create an AWS Lambda function to integrate with your AppSync API
with QLDB.
Lambda allows you to run code without having to manage servers.
Now with HIPAA, you've got to encrypt all the data that hosts PHI.
In Pushkar's app that means encrypting data in transit that passes from the
internet through Lamdda and to QLDB.
It also means encrypting data at rest in QLDB.
Fortunately, QLDB by default, encrypts your data at rest,
make sure that every call you make over the network is encrypted.
To do that, you need a TLS Certificate which can be managed
through AWS Certificate Manager.
Certificate Manager lets you easily provision, manage and deploy public
and private SSL, and TLS certificates for use with AWS services
and your internal connected resources.
You also need to audit who has access PHI.
So be sure to enable Amazon CloudTrail and turn on audit
logging wherever PHI is processed.
CloudTrail records activity made on your account and delivers log files
to your Amazon Simple Storage bucket.
You've also got to be able to demonstrate that your application
is meeting the HIPAA rules.
AWS Audit Manager automates evidence collection to make it easier to assess
if your policies, procedures, and activities are operating effectively.
Audit Manager provides a pre-built framework that supports HIPAA rules
to assist you with your audit preparation.
All of this put together helps you build an application on top of AWS that
meets the requirements outlined in HIPAA and helps you secure and protect PHI.
Does that mean that you're HIPAA compliant, and you're done?
Not exactly.
This only represents a portion of the HIPAA compliance journey.
There may be other controls you need that are specific to your business.
You also want to check out the architecting for HIPAA white paper.
It explains more about HIPAA than I could in this short video.
I've left a link to the white paper in the description of this video.
Now it's time for a recap.
Don't start building until you have a BAA.
Make sure you only use HIPAA eligible services.
These are the HIPAA eligible services that I covered today.
Sign into your app with Amazon Cognito.
Build an API with AWS AppSync.
Use AWS Lambda to get data from Amazon Quantum Ledger Database.
Always encrypt both in transit and at rest.
Make sure you're gathering evidence to demonstrate
compliance with AWS Audit Manager.
Show your auditors that you've got HIPAA compliance on lockdown, and celebrate.
That's how you build for HIPAA compliance.
Not so scary now.
Right?
Check out the links in the description of this video to get started on
building your health care app.
It doesn't matter when you start as long as you just get started.
Thanks for hanging out with me.
See you soon.