HIPAA compliance on GCP - Is it a shared responsibility?

[dheerajpanyam]

We have a customer looking to deploy a HIPAA compliant  application on GCP. GCP services used are GCE in a MIG, Cloud SQL and GCS.  How do i ensure the application is HIPAA compliant when deployed on GCP? . I read the whitepaper and it mentions data encryption is handled by Google which is fine but I am looking for things to watch out for both from the Infra side and the application side to ensure all the HIPAA standards are adhered to once the application is live on GCP.

[DamianS · Accepted solution]

Hello @dheerajpanyam  ,Welcome on Google Cloud Community.

I've found here : https://cloud.google.com/security/compliance/hipaa , recommended best practices for HIPPA along with essential best practices.  Also to be compliant with HIPPA, be familiar with covered products in Google Cloud BAA (Business Associate Agreement) : https://cloud.google.com/security/compliance/hipaa#covered-products . From general perspective:

1. Use HTTPS
2. Strict with least privilege at IAM
3. Prevent injection attacks ( SQL Injections, XSS, etc)
4. Consider data masking

HIPAA checklist : https://secureframe.com/blog/hipaa-compliance-checklist

--
cheers,
DamianS
LinkedIn medium.com Cloudskillsboost

[dheerajpanyam]

Thanks @DamianS