1. Protecting our members, our company, and our selves
A DBA’s Guide to HIPAA
Protecting our members, our company, and our selves

2. A little about me @SQLServerNerd Vice President Event Chair
Forums Administrator
2 |
9/19/2018 |
A DBA’s Guide to HIPAA

3. What is HIPAA?
Health Information Portability and Accounting Act (1996)
Establishes requirements for working with protected information
Establishes a civil and criminal penalty structure for violations
HITECH act addresses computerized systems
3 |
9/19/2018 |
A DBA’s Guide to HIPAA

4. What is protected Names Address Social Security number Family History
Telephone number
Fax number
Account numbers
Medical record number
address
Dates (birthday, admission/discharge)
Certificate/license numbers
Vehicle ID (license plate, serial #)
Personal Assets
Device identifiers and serial numbers
Biometric (finger or voice print)
Photographs
Geographic indicators (zip codes for areas with 20,000 or less people)
Any unique identifying number, code or characteristic
4 |
9/19/2018 |
A DBA’s Guide to HIPAA

5. Why do our companies care?
Up to $1.5 million annual fine for each provision violated
Up to 10 years in prison
Loss of trust in the company with members and partners
5 |
9/19/2018 |
A DBA’s Guide to HIPAA

6. Why do we as DBAs care? Penalties can be potentially pass-thru
We can act as a line of defense.
DBA = Default Blame Acceptor
6 |
9/19/2018 |
A DBA’s Guide to HIPAA

7. DBA’s Pillars of Compliance
Security
Compliance
Encryption
Auditing
Image by Jason Swearingen licensed under Creative Commons
9/19/2018 |
A DBA’s Guide to HIPAA

8. Security
Use AD groups when possible and plan out access based on need.
Review periodically
Consider temporary grants
Review developers data access code
Avoid moving data across tiers
Separate any public facing servers (web) as much as possible from direct SQL Access
Linked servers can be a huge risk
8 |
9/19/2018 |
A DBA’s Guide to HIPAA

9. Encryption Encrypt your backups
Consider TDE or a 3rd party solution
All transmission of protected information need to be encrypted
Encrypt at a cell level any data that exists outside your organization
In a public facing DMZ for example
9 |
9/19/2018 |
A DBA’s Guide to HIPAA

10. Auditing You will be audited regularly
Audit access to key systems containing protected information such as
Claims information
Care management
Create queries ahead of time to make it easier to give your auditors what they want
Audit Yourself.
10 |
9/19/2018 |
A DBA’s Guide to HIPAA

11. HIPAA in the cloud.
A Business Associates (BA) agreement will likely be required
This will limit your options
Azure offers a BA for some of its services but not others
You have an obligation to know where your data is at all times
11 |
9/19/2018 |
A DBA’s Guide to HIPAA