The Health Insurance Portability and Accountability Act (HIPAA) requires organizations that hold health records and related personally identifiable information to keep that data private for extended periods. The ultimate goal is to provide a framework that, coupled with enforcement, ensures patient healthcare data is limited to those with a stated need to know.
As technologists, it’s easy to view HIPAA compliance as a technology challenge. In reality, organizations can achieve compliance only through a combination of training, business policies, and technology. That said, the VAST AI Operating System provides the technology to enforce organizations' HIPAA compliance policies, as described below.
Encryption at Rest and in Flight
The HIPAA security rules require organizations to “implement a mechanism to encrypt ePHI whenever deemed appropriate” to guard against unauthorized access to ePHI (electronic personal health information) transmitted over an electronic communications network.
The VAST AI OS allows customers to encrypt data when stored on the system's SSDs (encryption at rest) to ensure that the data on the system’s SSDs is unreadable without their encryption keys. A VAST system’s CNodes encrypt all the data and metadata they write to the system SSDs in software with no requirement for premium-priced self-encrypting SSDs. Data is encrypted with AES-256 using FIPS 140-3 validated libraries. VAST systems can manage encryption keys internally or use an Enterprise Key Manager (EKM) like Thales CypherTrust, Fornetix VaultCore, supporting the Key Management Interoperability Protocol (KMIP). When a VAST customer uses internal keys, all system data is encrypted with the same encryption keys. With an external EKM, customers can use and expire different encryption keys for each tenant, or even assign different keys to select folders.
VAST systems also support data encryption in flight between clients and the VAST system’s CNodes. The access protocol defines the methods used to encrypt data in flight. VAST supports encryption of NFS 3 traffic via TLS, NFS 4.1 via TLS and Kerberos, SMB 3.0 encryption, and HTTPS (HTTP with TLS encryption) for S3, database access, REST API access, and other HTTP access. Replication traffic between VAST clusters is protected and encrypted using mTLS.
Retention Locks and WORM Capabilities
HIPAA compliance isn’t all about security. HIPAA also requires providers to retain ePHI for 20 years or more. To support compliance with these requirements, VAST offers retention locks and WORM (Write Once, Read Many) capabilities to further bolster data integrity and preservation.
Retention locks prevent data from being deleted for a set period, which is essential for compliance with healthcare legal and regulatory requirements. These locks can be enacted on folders or buckets using S3 Object Lock or the well-understood file locking semantic of
setting the retention date and then flagging the file Read-Only to prevent writing to or deleting the file until a predetermined date.
WORM functionality further ensures that once written, data cannot be overwritten. These two functional components are critical for maintaining the fidelity of medical records, protecting them from tampering or accidental deletion.
Client Isolation through VIP
The VAST architecture employs Virtual IP (VIP) technology to provide client isolation, a critical feature for creating secure multi-tenant environments. By isolating client environments within the healthcare network, VIP helps prevent unauthorized access and data leakage between clients, which is paramount for maintaining patient confidentiality and compliance. Further, VAST integrates with Lightweight Directory Access Protocol (LDAP) providers such as Microsoft’s Active Directory, OpenIDAP, and FreeIPA to provide role- and attribute-based access control (ABAC) to system resources.
Immutable Snapshots
VAST’s architecture incorporates immutable snapshots, which are crucial for preserving data integrity in healthcare. These snapshots prevent data from being altered or deleted once taken and are critical for recovery as ransomware attacks against healthcare institutions increase. This is especially vital in healthcare, where patient data must remain unchanged once recorded, ensuring historical health records are preserved accurately for ongoing medical care, billing, and auditing.
Conclusion
Combining these features and the core tenets of Zero Trust within the VAST architecture provides a comprehensive suite of security measures that align with HIPAA regulations, ensuring that healthcare providers can confidently manage and protect patient data while complying with the stringent guidelines and enforcement. With VAST, healthcare IT infrastructures are not only compliant but are also positioned at the forefront of technological innovation, leveraging the best practices in data security and management.
