CancerDocs: HIPAA compliant Healthcare Software Development.

CancerDocs is a HIPAA compliant healthcare software platform that gives its users private, online-based medical consultations on cancer-related topics. The platform serves as a bridge between authorized healthcare professionals and patients who need medical consultation. Because it deals with electronic private medical information, CancerDocs has to guarantee the confidentiality of all input data, which means it must comply with HIPAA Security Rules. HIPAA compliance means the system meets a set of established security standards that protect sensitive patient information.

Medicine is a highly regulated industry when it comes to information-security compliance for any resource, including web applications. As a healthcare provider that deals with protected health information (PHI), CancerDocs has to ensure the required technical, networking, and security measures are followed. The main challenge for our team was building software in correspondence with HIPAA Security Rules, which define what has to be covered, what information has to be protected, and what safeguards must be in place to appropriately protect electronically protected health information.

On top of that, the system had to be user-friendly and convenient for communication between doctors and patients.

Before we started working on the project, we made an in-depth study of the HIPAA Rules, which consist of several milestones such as access control, audit controls, integrity, person or entity authentication, and environmental and transmission security. While the service is in use, all patient data is created, received, used, processed, maintained, and saved by a covered entity. That entire process was technically covered and implemented to ensure confidentiality, integrity, and security by means of:

• Abtible Container Platform: designed to deploy docker containers into a secure, isolated, HIPAA-ready environment. Each PHI-ready stack runs in its own AWS Virtual Private Cloud, with databases and internal services in a private subnet that is inaccessible from the internet. This helps cover integrity controls and the measures put in place for confirming that ePHI has not been altered or destroyed, and the data is hosted so that it is protected against unauthorized public access, including every method of transmitting data.

• Docker tool: builds an environment on a remote server that makes it easier to develop, deploy, and run applications using containers. Developers do not have access to the databases, and access control allows only authorized users to reach electronic protected health data.