Best practices for handling sensitive personal data
The engineering habits expected of any application handling sensitive personal data, from access logging to encryption to retention, explained plainly.
What this covers
Regulations that govern sensitive personal data, HIPAA in the United States among them, mostly ask for a small number of engineering habits. Only the people who need the data should be able to reach it, and every access should be recorded, so an investigation can answer who saw what. Data should be encrypted both while stored and while travelling. It should not be kept longer than there is a reason to keep it. And it should never be copied into places nobody thinks of as a database, such as application logs, error reports or a test environment.
Voroa does not offer a business associate agreement and does not support hosting protected health information. This page explains general practice; it is not a compliance claim, and it is not legal advice.