HIPAA, unlike many other compliance standards, cannot be "certified." This can lead to certain levels of open interpretation, but best practices are generally a

HIPAA, unlike many other compliance standards, cannot be "certified." This can lead to certain levels of open interpretation, but best practices are generally agreed upon. Products like TrueVault provide excellent value, but security awareness training is the golden key to improve an organization's information security posture. For an example of what I mean, consider the following scenario: - Patient data (called Protected Health Information, or PHI) is stored securely in a TrueVault database. This database is accessible only from the hospital, and TrueVault has signed a BAA with the covered entity. - A surgeon is prepping a kidney transplant for patient John Smith. The surgery is tomorrow morning, and Dr. Goofböl wants to make sure he's familiar with the patient's medical history. - Dr. Goofböl, an authorized viewer of this patient's PHI, accesses the data and begins to take notes. A new batch of PHI is now being created, as it contains medical information as well as identifying information of the patient (say, his name). - Dr. Goofböl emails this document to himself (whether his work or personal email address--it doesn't really matter), and goes home for the night. - Dr. Goofböl stops at a nice coffee shop on his way home, and his personal laptop (without full-disk encryption) is stolen. The data is lost, and cannot be accounted for. My company provides HIPAA Security Risk Assessments, and I've seen this exact scenario play out many times, albeit with other "HIPAA compliant storage" solutions, rather than TrueVault. There is absolutely a place for secure products like this, but security awareness training and the true gravity of identity theft and information loss needs to be ingrained in the medical industry. "Security" for a hospital used to mean protecting doctors and patients from intruders (or mentally unstable patients). It used to involve burly men in white clothes; they're not used to thinking about where their information is traveling. Furthermore, the government is mandating that electronic health information be available to patients through web-based patient portals, which introduces a whole different level of potential vulnerabilities. I truly believe that the healthcare technology industry is going to be one of the most booming sectors of the next decade, but there are major changes that need to occur to facilitate that. Hospitals need better IT infrastructures, more attention needs to be paid to security, and better tech personnel need to be brought into these environments. Only then can the next generation of healthcare technology truly succeed.