Thanks to some help I think I got a grips on HIPAA. Let me know what you think.
HIPAA:
Relevant for all data which is PHI & PII: Example: Johann (PII) has a broken leg (PHI).
PII: Personally identifiable Information
PHI: Protected Health information
PHI relevant data has to be:
- Encrypted at rest
- Secured in transit
- Only accessed by people needing to access the data
Implications:
1. Encrypted at rest:
PHI data needs to be encrypted at rest in all stages and systems.
- Salesforce:
- Shield Platform Encryption in SF
- Not for Big Object / External Object
- SF Standard field encryption -> Small number of PHI
- Only certain custom fields
- Not files
- Can’t bring your own key
- Shield Platform Encryption in SF
- Privacy Shield in Heroku
- DWH needs to be HIPAA compliant
- Shield for Einstein Analytics, not available for EA plus
2. Secured in transit:
- Mutual SSL on integrations (e.g. SF to ESB)
- NOT: Emails (Cannot be encrypted unless specialized tool like Data Motion)
- Ask cust. to log-in.
3. Only accessed by people needing to access the data
-> Everything private, only open up what's needed
Other implications:
- Data masking in full copy sandbox needed to protect data from testers .
- Anonymized/dummy data in Dev Sandboxes
- Anonymized (global) reporting if necessary/possible
@Johann Furmann- My biggest concern with HIPAA as an admin is standard fields that need to be "private". Specifically, Account Name, phone, email. Do I need to change the ACCOUNT Name (using person Accounts) - to something other than the persons first name / last name? Do you create Custom Fields for each of these standard fields that are used across different record types to keep users from being able to see that data?