(Disclosure: I'm a co-founder of Aptible.)<p>As noted in other comments, most of HIPAA is not technical. Most of the requirements relate to risk assessment, policies, training, incident response, etc.<p>With that in mind, I'm going to quickly run down all of the major moving parts and then cover some of the technical considerations for setting up a server.<p>HIPAA has three main rules you need to comply with:<p>1. The Privacy Rule - Governs the use and disclosure of PHI (protected health information). Applies to all forms of PHI (verbal, written, electronic, etc.).<p>2. The Security Rule - Governs safeguards for electronic PHI<p>3. The Breach Notification Rule - Governs your responsibilities during a security or privacy incident<p><i></i><i></i><i></i><i></i><i></i><i></i><i></i><i></i><p>The Security Rule has a general security standard, some documentation/retention rules, and three sections of safeguards. They are:<p>1. Administrative Safeguards<p>2. Physical Safeguards<p>3. Technical Safeguards<p>Some of the safeguards are mandatory. Some are "addressable," meaning if you don't implement them you must document why you chose not to and what other safeguards you applied instead.<p><i></i><i></i><i></i><i></i><i></i><i></i><i></i><i></i><p>Most likely, you're going to start with something like the following for your servers:<p>1. Sign a BAA with any service provider who is going to touch PHI for you.<p>2. Restrict physical and logical server access to authorized individuals. Document how you restrict access and why the methods chosen are reasonable and appropriate given the risk posture of your organization. (There's a LOT packed into this step.)<p>3. Log all access and data modification events. If you use a logging service that isn't HIPAA-compliant, make sure you're not including PHI data you send them.<p>4. Encrypt data at rest and in transit, including inside the network perimeter. Document your network topology and access points.<p>5. Implement backups according to your organization's HIPAA contingency/disaster recovery plan. Document the backup scheme.<p>A few caveats:<p>- I haven't addressed application-level security. The same requirements apply, but the implementation differs.<p>- Your customers will demand additional safeguards that aren't in HIPAA.<p>At Aptible, we help with all of this, plus all of the other requirements (risk assessment, policies, training, etc.), so you can get a complete handle on your compliance status.