The above incident underscores one of the most concerning aspects of information security in the healthcare world – providers relying on their vendors to provide adequate security measures for systems containing PHI. However, not even the most stringent contractual protections will prevent this story from slapping on the front page of the Wall Street Journal and the OCR “Wall of Shame.” Luckily, your data breach insurance policy and BAA indemnification provisions will offset a lot of the cost to other parties. All told, this event will be a costly one: at an average of $200/patient in notification and credit monitoring services, the total cost of the breach will balloon above $6 million. You even try to preempt future class action lawsuits by offering free credit monitoring services to the patients. You begin preparations to notify each and every patient whose data was compromised. You can see a screenshot of such configuration here below.A data breach has indeed occurred. It means that the moment you install it, the server comes with a default configuration that is already HIPAA compliant. If you’re using Server!, HIPAA compliance comes out of the box. You should configure your server to offer only the most stable and reliable versions of the protocol: SFTPv3, SFTPv5, SFTPv6. On top of that, to complicate things even more, the SFTP subsystem protocol comes in 7 different versions (numbered from 0 to 6), none of which is 100% standardized. Avoid plain/unencrypted crypto schemes (obviously).Avoid known “broken” MAC algorithms (like MD5).Avoid bit-lengths lower or equal to 96 for encryption algorithms.Avoid algorithms known for being “broken” (like DES).Therefore, in order to comply to the HIPAA regulation, you have to make sure your SFTP (SSH) server only offers strong cipher suites during the initial negotiation phase:

If the server offers some weak algorithms during such phase, and if the client elects to use one of them, then the security level drops tremendously, and HIPAA compliance is gone. During such phase, the client and the server negotiate a range of supported encryption (protection) and MAC (verification) algorithms. SSH is a very fine-grained protocol when it comes to security, in fact it features a very effective “security scheme negotiation” upon connection establishment. Whether you’re compliant or not strongly depends on how you configure your SFTP server’s security settings.įirst of all it is important to understand that SFTP is not a stand-alone protocol, it is actually a subsystem of the SSH protocol, and therefore securing your SFTP file transfers means making sure that the SSH channel that’s around them is secure. Some people believe that simply switching from FTP to SFTP will make their file transfers compliant to the HIPAA regulation.

Macbook encryption hipaa