5 ms·

We currently pay $250/month through some small vendor for hipaa compliant sftp hosting (that we transfer a whopping 50kb on a weekly basis). I always felt like

We currently pay $250/month through some small vendor for hipaa compliant sftp hosting (that we transfer a whopping 50kb on a weekly basis). I always felt like it was a rip off, but azure/aws didn't have their own version. And I'm loathe to manage a VM. PaaS is my sugar bear. My eyes lit up when I saw this. We're an azure shop, but I'm not afraid to use AWS for limited cases. Then I saw - $.30/hr (so, $214/mo). Really? REALLY? Wouldn't it be comically easy to just the add SFTP as a protocol option for S3? Why does this need a dedicated VM to run it? (Yes, I know this is PaaS and you don't manage the VM, but they're essentially pricing it that way)

jimktrains2 8y ago
I don't know about comically easy, but should be doable to have some sort of shared frontend. $214 (even $100) is a really beefy vm, though. I wonder whats provisioned and why.
- tecleandor 8y ago
  Nothing beefy, probably, but as for HIPAA compliance, AFAIK, you need to sign several specific contracts with your provider and blahblahblah, probably they're just billing you for the incovenience and for having the HIPAA seal. "I'm HIPAA, the rest aren't, just pay for it".
  - pg_bot 8y ago
    You have to sign a single business associate agreement (BAA) depending on the nature of the business you are working with. These are usually boilerplate contracts around 2-3 pages long and full of legalese. It is uncommon for someone to charge you for signing a BAA. It is very common to tie these plans into enterprise only pricing. This is terrible because it adds unnecessary costs to the medical system (which get passed onto consumers) and it completely shuts out smaller players from entering the marketplace. (Cue me side eyeing every single error tracking software SaaS currently on the market who wants to start at 5K a year for their 'small' plan - get real guys)
    - tecleandor 8y ago
      Yep, I was checking the DICOM (medical images) Viewer plugin for Box the other day and, yeah, they don't charge you for the BAA, but you're required to get an Enterprise or Elite plan, which price isn't even listed, and probably on the thousands: "Pricing for Box Enterprise or Elite plans as well as the DICOM Viewer additional seat surcharge can be handled by our Box sales team once we know how many seats your are looking for across your company and what types of collaboration use cases you need. "
  - dragonwriter 8y ago
    > and for having the HIPAA seal. “HIPAA seals”, which several vendors offer, are mostly BS and have no actual meaning under HIPAA. I don't think any big vendor has them (Google's HIPAA page explicitly notes that no certifications are recognized by the government.)
rhacker 8y ago
HIPAA compliance, even on AWS is extremely expensive. I believe the best vendor to get HIPAA (someone correct me if I'm wrong) is to go with Google Cloud. Last time I checked did not charge any extra for HIPAA BAA signing. Edit: I stand corrected on this, AWS no longer requires dedicated hardware for BAA HIPAA: Sorry I didn't look this up, I had old information. https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-removal-of-dedicated-instance-requirement/ https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-re...
- viggity 8y ago
  We're on Azure and they definitely don't charge for a BAA. And it doesn't appear that AWS does either.
  - rhacker 8y ago
    AWS requires you to use single tenancy hardware to be covered by that BAA. OH I stand corrected: https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-removal-of-dedicated-instance-requirement/ https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-re...
- pg_bot 8y ago
  AWS is IMO the best vendor if you are looking to for HIPAA compliant cloud computing. Our bills are higher than they would be for a non-medical application, but nothing astronomical. Programmer time is still way more expensive.
- IronWolve 8y ago
  My work has made the aggressive stance no HIPAA data on AWS due to the legal and billing issues, not a technical one. Technically it a good solution, and we might use it down the road. We already use AWS/S3 for firmware device updates.
egeozcan 8y ago
Can't you turn it on, run your scripts and turn off again? I agree that it's weirdly expensive though.
- scarface74 8y ago
  This is an enterprise offering. We gladly cough up more than this on almost every service so we don’t have to manage it. If something breaks, we just use our business support plan.
SEJeff 8y ago
Let me guess, you use BrickFTP?
partiallypro 8y ago
Couldn't you use an Azure webapp? It has FTP and user management, though not as granular as this. You should be able to use IAM to only allow the user access to that one web app and they can set their own username/password. Not quite as simple as sending out creds from one interface, but it's an option. Not sure how many users you have, obviously if you had tons and tons of users it would become a choir, but if it's just a few users I'm thinking a webapp could handle that. Alternatively, if trusted users enough, you could use an Azure blob and use CloudBerry. That one is probably not HIPPA compliant though. I don't even know if this new AWS SFTP plan is HIPPA compliant, don't you have to have a log of file check in/outs? And user login logs?
- scarface74 8y ago
  It’s using S3. S3 already has access logs - off by default - and for logins you have CloudTrail.
guitarbill 8y ago
For companies, $214/mo isn't much if it makes an admin's life easier. At the same time, Amazon isn't going to price it so it's attractive to everybody, because it sounds like they'd rather people not use it if possible. Sounds sensible to me, legacy stuff is always going to cost you one way or another.
Spooky23 8y ago
People spend millions on stupid stuff like this. The money saved on audit response would justify the service alone. Frankly, Amazon let a lot of revenue go here — I could think of a few orgs that wouldn’t skip a beat about spending 100x.

jimktrains2 8y ago

I don't know about comically easy, but should be doable to have some sort of shared frontend. $214 (even $100) is a really beefy vm, though. I wonder whats provisioned and why.

tecleandor 8y ago
Nothing beefy, probably, but as for HIPAA compliance, AFAIK, you need to sign several specific contracts with your provider and blahblahblah, probably they're just billing you for the incovenience and for having the HIPAA seal. "I'm HIPAA, the rest aren't, just pay for it".
- pg_bot 8y ago
  You have to sign a single business associate agreement (BAA) depending on the nature of the business you are working with. These are usually boilerplate contracts around 2-3 pages long and full of legalese. It is uncommon for someone to charge you for signing a BAA. It is very common to tie these plans into enterprise only pricing. This is terrible because it adds unnecessary costs to the medical system (which get passed onto consumers) and it completely shuts out smaller players from entering the marketplace. (Cue me side eyeing every single error tracking software SaaS currently on the market who wants to start at 5K a year for their 'small' plan - get real guys)
  - tecleandor 8y ago
    Yep, I was checking the DICOM (medical images) Viewer plugin for Box the other day and, yeah, they don't charge you for the BAA, but you're required to get an Enterprise or Elite plan, which price isn't even listed, and probably on the thousands: "Pricing for Box Enterprise or Elite plans as well as the DICOM Viewer additional seat surcharge can be handled by our Box sales team once we know how many seats your are looking for across your company and what types of collaboration use cases you need. "
- dragonwriter 8y ago
  > and for having the HIPAA seal. “HIPAA seals”, which several vendors offer, are mostly BS and have no actual meaning under HIPAA. I don't think any big vendor has them (Google's HIPAA page explicitly notes that no certifications are recognized by the government.)

rhacker 8y ago

HIPAA compliance, even on AWS is extremely expensive. I believe the best vendor to get HIPAA (someone correct me if I'm wrong) is to go with Google Cloud. Last time I checked did not charge any extra for HIPAA BAA signing. Edit: I stand corrected on this, AWS no longer requires dedicated hardware for BAA HIPAA: Sorry I didn't look this up, I had old information. https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-removal-of-dedicated-instance-requirement/ https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-re...

viggity 8y ago
We're on Azure and they definitely don't charge for a BAA. And it doesn't appear that AWS does either.
- rhacker 8y ago
  AWS requires you to use single tenancy hardware to be covered by that BAA. OH I stand corrected: https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-removal-of-dedicated-instance-requirement/ https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-re...
pg_bot 8y ago
AWS is IMO the best vendor if you are looking to for HIPAA compliant cloud computing. Our bills are higher than they would be for a non-medical application, but nothing astronomical. Programmer time is still way more expensive.
IronWolve 8y ago
My work has made the aggressive stance no HIPAA data on AWS due to the legal and billing issues, not a technical one. Technically it a good solution, and we might use it down the road. We already use AWS/S3 for firmware device updates.

egeozcan 8y ago

Can't you turn it on, run your scripts and turn off again? I agree that it's weirdly expensive though.

scarface74 8y ago
This is an enterprise offering. We gladly cough up more than this on almost every service so we don’t have to manage it. If something breaks, we just use our business support plan.

SEJeff 8y ago

Let me guess, you use BrickFTP?

partiallypro 8y ago

Couldn't you use an Azure webapp? It has FTP and user management, though not as granular as this. You should be able to use IAM to only allow the user access to that one web app and they can set their own username/password. Not quite as simple as sending out creds from one interface, but it's an option. Not sure how many users you have, obviously if you had tons and tons of users it would become a choir, but if it's just a few users I'm thinking a webapp could handle that. Alternatively, if trusted users enough, you could use an Azure blob and use CloudBerry. That one is probably not HIPPA compliant though. I don't even know if this new AWS SFTP plan is HIPPA compliant, don't you have to have a log of file check in/outs? And user login logs?

scarface74 8y ago
It’s using S3. S3 already has access logs - off by default - and for logins you have CloudTrail.

guitarbill 8y ago

For companies, $214/mo isn't much if it makes an admin's life easier. At the same time, Amazon isn't going to price it so it's attractive to everybody, because it sounds like they'd rather people not use it if possible. Sounds sensible to me, legacy stuff is always going to cost you one way or another.

Spooky23 8y ago

People spend millions on stupid stuff like this. The money saved on audit response would justify the service alone. Frankly, Amazon let a lot of revenue go here — I could think of a few orgs that wouldn’t skip a beat about spending 100x.