HIPAA Compliant WordPress Hosting - Requirements for HIPAA WordPress hosting
SSAE 18 SOC 1 SOC 2 (formerly SSAE 16) Certified and HIPAA, HITECH Audited
SSAE 18 SOC 1 SOC 2 (formerly SSAE 16) Certified and HIPAA, HITECH Audited
HIPAA WordPress Hosting
If your WordPress website interacts with anyone’s electronic protected health information (ePHI), ensuring that your WordPress website is HIPAA-compliant will be critical to your long-term success. By choosing to host your website on Atlantic.Net’s servers, you can rest assured that your data and interactions between devices are shielded by a tough security layer. Furthermore, our installation process is fast and easy, and the entire infrastructure is HIPAA-compliant. Find out how to Make Your WordPress Website HIPAA Compliant here.
To help you meet and even exceed the parameters of the HIPAA Security Rule for your WordPress site, Atlantic.Net guarantees you the following protections:
Our full spectrum firewall guards your network’s periphery against malicious intruders from implementation to a round-the-clock log monitoring. In addition, Atlantic.Net will maintain close oversight of your network gateway points, a robust security response in the event of a breach, and regularly scheduled device health checks.
Different from a firewall, IDS monitor network traffic for abnormal activity, such as late-night logins or access to files by unauthorized agents. This security layer compliments the firewall by scanning for attacks that come from within the network. Our IDS meet certification requirements and is in compliance with the American Institute of CPA’s SOC 1, SOC 2, or SOC 3 (SSAE 18).
This service protects your data transmission by sending it via an encrypted VPN tunnel. Additional services include SSL web certificates to validate ownership for sites that house access points to sensitive data and client connections.
Our encrypted backup service takes your HIPAA compliance to the next level, automatically encrypting your data before it is written to a disk using Advanced Encryption Standard 256-bit. Here, each encryption key used to conceal data is encrypted with master keys. AES-256 is the only publicly accessible encryption cipher that’s been approved by the National Security Agency (NSA) to protect top secret information.
Critical to meeting HIPAA compliance requirements, our log management service oversees the full administration of transmission, analysis, storage, archiving and disposal of your log data.
Using Atlantic.Net’s One-Click Install, you can install your WordPress website in seconds. All you have to do is choose name, size and location of your server, select the WordPress application, and you’re done! Once your installation is complete, you’ll receive a link to begin setting up your website.
The WordPress application is housed on a LAMP stack using Ubuntu 16.04 LTS. As an option, you can add your SSH key and select backups.
Not sure what you need?
Get a free consultation today!
Contact Sales Today!
Case Studies
Whitepapers
Resources
Risk Analysis is still a requirement of the HIPAA Security Rule, so by gathering the necessary knowledge, you are attending to this critical compliance step and taking proactive steps to minimize liability.
To assess the current risks that may be present to your system, you should first clarify the purpose of your WordPress site. Will it be publicly accessible, or was it created for internal purposes? Will you be processing, storing, or transferring any type of ePHI? What security controls and policies are in place to safeguard your data? And finally, what does the threat landscape look like and what are the potential impacts of those threats on your organization?
To round off the security process, make your WordPress site meet the following five key control requirements:
WordPress offers a combination of security configurations to help you prevent unauthorized parties from accessing your data. You can modify user roles, or use a plugin module to disable access to certain users.
Audit controls allow you to deploy equipment, programs and processes to monitor access points and behavior within IT portals that contain highly sensitive ePHI.
Include an authentication method to verify the identity of the person or entity that is accessing your data. At the minimum, confirm that the privileges are valid and transmission devices sound.
To make sure that the integrity of your data is maintained at all times, install a tool that verifies and reports that no alteration or destruction of data is taking place.
Add a layer of transmission security to protect against the possible compromise of the electronic protected health information flowing through the system.
Highly Available Infrastructure
Business Associate Agreement
Fully Managed Firewall
Intrusion Detection System
IP Reputation
Blended Bandwidth
Linux & Window Servers
Anti-Malware Protection
Vulnerability Scans
Encrypted Backup, Storage, & VPN
Log Management System
Dedicated to Your Success
– Jason Coleman
VP of Information Technology, Orlando Magic
"After evaluating a range of managed hosting options to support our data operations, we chose Atlantic.Net because of their superior infrastructure and extensive technical knowledge."
- Erin Chapple
General Manager for Windows Server, Microsoft Corp.
"Atlantic.Net’s support for Windows Server Containers in their cloud platform brings additional choice and options for our joint customers in search of flexible and innovative cloud services."
Contact an advisor at 888-618-DATA (3282) or fill out the form below.
To deliver HIPAA compliance within WordPress, the first step is to understand the basics of HIPAA-compliant IT and hosting. Relative to the specific deployment, perform a risk analysis and then build a HIPAA-compliant website in WordPress with five basic concerns in mind.
Why is this form of compliance needed? Organizations in healthcare and their service providers want to avoid federal fines but also want to generally prevent compromise. Healthcare data breaches increased 40% from 2015 to 2016, so now it is even more critical to pay attention to defenses for your protected health information (PHI) – particularly the electronic protected health information (ePHI) safeguarded within data environments.
If you are a healthcare company or otherwise interact with individuals’ ePHI, your first consideration should always be verifying that the system is HIPAA-compliant. For instance, a HIPAA-compliant hosting company has all the necessary protections in place to meet and exceed the parameters of the HIPAA Security Rule (fully managed firewall, encrypted VPN, encrypted backup, log management system, intrusion detection system, etc.), as indicated by certifications such as auditing to show compliance with the American Institute of CPA’s SOC 1, SOC 2, or SOC 3 (SSAE 16). To understand HIPAA compliance further, read A Beginner’s HIPAA Compliance Guide.
While having the right host is critical, you need more than HIPAA-compliant hosting services in order to protect yourself from violation. The preliminary step is a risk analysis.
A risk analysis is key because it gives you two basic positive outcomes: You should get assurance that the system you are using to serve your HIPAA-compliant WordPress installation is able to properly safeguard the data. Plus, it is actually the first step of meeting the HIPAA Security Rule, so you are taking an initial compliance step by gathering that knowledge.
Note that a risk analysis really is necessary and not optional if you want your HIPAA-compliant WordPress hosting. It is not permissible to skip because you believe that you have no risk, and it is not an aspect of your business that you can entirely entrust to a third party – simply because your organization is ultimately held liable. This process allows you to review the current risks that are present to your system (and to develop the best strategy moving forward). Once you have that risk analysis documentation in place, then you can focus on the need to have a HIPAA-compliance program that is sustainable.
What is involved in a risk analysis to properly protect your WordPress hosting environment from HIPAA violations? Putting one together involves answering important questions about your environment, as indicated by Donna Grindle of HIPAA training firm Kardon Compliance:
Once you have answered the questions of a risk analysis, it is time to think in terms of the controls you want to implement on your HIPAA-compliant WordPress site. You will be able to meet the requirements set by the Health and Human Services Department (HHS) through either the standard system, immediately available plugins, or custom tools. From a broad perspective, your environment should meet five key control requirements – all of them described by the Security Rule’s language on technical safeguards.
First, your HIPAA-compliant environment will need access controls. A covered entity or business associate needs to put technologies and systems into place that will prevent any unauthorized parties from accessing the data.
You can achieve that through WordPress via a combination of security configurations and plugins. You can take the standard installation and modify user roles, making sure that permissions work for administrators, the public, and staff.
Keep in mind, though, that the standard authorization capabilities within WordPress are relatively basic. You might have to get a plugin to disable a content type or module when users have not been authorized. For instance, you need a plugin in order to allow users to edit content, while not giving them access to the ePHI data that is within calendar registrations.
Second, as a covered entity or business associate, you will need audit controls. That means deploying computing equipment, programs, and processes to monitor access and behavior within IT portals that contain ePHI.
Third, HIPAA-compliant WordPress hosting requires integrity controls. In other words, you must make sure that data integrity is maintained at all times (i.e. that data is not destroyed or unintentionally altered). Plus, there should be a mechanism installed that can verify that alteration or destruction of data is not occurring.
A fourth key defense outlined within the Security Rules is person or entity authentication. You can verify identities of users through various person or entity authentication methods. At the bare minimum, a covered entity or business associate will want to confirm the privileges and transmission device are valid.
Finally, a HIPAA-compliant organization has to build transmission security into its environment. These methods protect against the possibility of compromise to the ePHI that is flowing through the infrastructure.
When you think of all these controls, it becomes apparent that a big piece of any HIPAA-compliant WordPress site is, in fact, the hosting. As Greg Gholson of web development firm Geonetric noted, “Anybody planning to build a HIPAA-compliant site needs to host in a HIPAA-compliant environment.”
Before you can build HIPAA-compliant WordPress, you need a web host that has the healthcare IT knowledge to set up a system that will truly protect you from breach. At Atlantic.Net, our healthcare hosting is SOC 1 and SOC 2 certified and HIPAA audited, designed to secure critical data and records. See our HIPAA compliant WordPress hosting plans.
© 2018 Atlantic.Net, All Rights Reserved.
We use cookies for advertising, social media and analytics purposes. Read about how we use cookies in our updated Privacy Policy. If you continue to use this site, you consent to our use of cookies and our Privacy Policy.
