7

Is the Magento platform HIPAA compliant? We want to use it for a healthcare eCommerce platform.

2
  • Can you provide us with a link to more info about HIPAA? All I found was hhs.gov/ocr/privacy Feb 25, 2015 at 18:32
  • Magento is not designed with HIPAA compliance in mind, though most of the requirements are a function of implementation rather than software. A certified HIPAA audit would likely be able to answer the question.
    – benmarks
    Feb 25, 2015 at 19:23

2 Answers 2

6

HIPAA compliance is a lot like PCI compliance, frankly. So - any system or platform, even if designed to be compliant, can become non-compliant if it's not setup or maintained correctly.

One thing that no one has mentioned yet here that's very important with HIPAA compliance is the concept of PHI - protected health information.

PHI is defined, roughly, as individually identifiable health information (which includes demographic information) collected, created or received by a health care provider, health plan, employer or health care clearinghouse.

Under HIPAA, all PHI has to be treated roughly with the same requirements and security precautions as credit card data is under PCI terms. This includes, actually notification requirements - if PHI is compromised, you may have the same (or higher) requirements to notify the impacted individuals as you would if their credit card data was stolen from your website.

PHI has been interpreted very broadly by the courts to include even a patient's name. So, if you're setting up a healthcare eCommerce platform, you're looking at needing to encrypt pretty much everything you store, down to the patient's name. This is not something that Magento, or any other eCommerce platform, does by default.

The good news is - it's not that challenging. Once you understand what you need to encrypt and protect, you can design a Magento extension to handle it. The hardest part, honestly, is wrapping your head around all of the various bits of data you have to secure and encrypt, and once you have that list, you just get to work setting up the proper protections for it.

I will say that Magento Enterprise is going to present a better base for a project like this. Some of the PCI Compliance elements built into Enterprise, especially things like the admin action/audit log, will go a long way towards getting you HIPAA compliant.

My first programming gigs, way back in the 90's, were in the medical industry, and I was there as HIPAA was first rolled out (fun times). So, if you have any other HIPAA questions, let me know. I'm not a lawyer, but I can help point you in the right direction towards building a HIPAA compliant eCommerce platform if you're interested in that.

4

Great question.

Doing some quick research, it appears there are 7 steps to be compliant.

  1. Transport Encryption: Is always encrypted as it is transmitted over the Internet
  2. Backup: Is never lost, i.e. should be backed up and can be recovered
  3. Authorization: Is only accessible by authorized personnel using unique, audited access controls
  4. Integrity: Is not tampered with or altered
  5. Storage Encryption: Should be encrypted when it is being stored or archived
  6. Disposal: Can be permanently disposed of when no longer needed
  7. Omnibus/HITECH: Is located on the web servers of a company with whom you have a HIPAA Business Associate Agreement (or it is hosted in house and those servers are properly secured per the HIPAA security rule requirements).

Source: https://luxsci.com/blog/what-makes-a-web-site-hipaa-secure.html

I don't believe Magento, by itself can actually meet these requirements. I think this would be more on your technology strategy and hosting provider.

Quickly going over the 7 steps above.

  1. SSL (get the best kind available)
  2. This is a strategy you need to talk with your host.
  3. This is all on your company & your host.
  4. This is all on your developers.
  5. This is all on your host.
  6. This is all on your host.
  7. This is all on your host.

If I were you, I would reach out to some of the bigger Magento Hosting Providers and discuss these challenges with them. While I won't make recommendations on which one to go to, I have positive experiences with Nexcess, Rackspace, and Sonassi Hosting. I am sure at least one of these providers (if not all) have dealt with HIPAA customers presently or in the past.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.