Our infrastructure is built entirely on AWS and we went through the HIPAA process to ensure that our system is HIPAA-compliant. Where should we look or what next steps can we take to obtain other certifications (e.g. ISO 27001, SOC 1/2/3)?
-
2When you say "the HIPAA process," what do you mean? Have you received certification from some body, like HITRUST, regarding HIPAA compliance? AWS is ISO27001 and SOC-2 compliant. – Herringbone Cat Feb 10 '17 at 20:17
-
You might want to consider EHNAC. You would probably get (at least) two accreditations: one associated with your application and CEAP for the fact that you are implemented in the cloud. – Rob Aug 10 '17 at 11:41
-
Certifications are not Pokemon; you do not need to catch 'em all. Which one do you *need*? That will tell you what to look for next. We cannot tell you which ones to get or what steps you might need to take from your current state, since we have no idea about your infrastructure. – schroeder Jun 02 '20 at 15:36
3 Answers
In order to be HIPAA compliant, you should have verified a substantial amount of your configuration is properly secured, otherwise you or your client will be subject to the financial penalties which come with HIPAA.
My suggestion would be to go back to whoever handled your HIPAA compliance testing and ask which certifications you are closest to, and proceed that way. Then you can look at the business need for other certifications.
![](../../users/profiles/6253.webp)
- 123,438
- 55
- 284
- 319
![](../../users/profiles/92295.webp)
- 382
- 1
- 6
The answer to this question is extremely broad. Risk & Compliance represents an important field within Cybersecurity, similar to application security or secure networking, so you probably need someone with a specialty in this (is my guess).
Also, before doing anything you're going to want to figure out which compliance framework to pursue. Each one is different, and the most valuable one depends a lot on the nature of your business. A Risk & Compliance manager or consultant may be able to help with this.
![](../../users/profiles/6253.webp)
- 123,438
- 55
- 284
- 319
![](../../users/profiles/189824.webp)
- 913
- 4
- 12