HIPAA & PCI DSS Hosting Requirements: Essential Compliance Checklist

Hosting compliance is something many people aren't so clear on but don't worry – it's not as scary as you might think! I've dealt with my fair share of these rules, and I've learned one thing very quickly – they're something you can't ignore. Have you ever been uncertain about what rules you need to follow for your hosting? I certainly have! So now, let's really break down HIPAA and PCI DSS in simple language.

What HIPAA Means for Hosting​

Hipaa protects health information. If a website or application holds or utilizes medical data, the website/app must comply with Hipaa. I helped my friend create a health app, and let me tell you – HIPAA really made me double-check everything! But at least the data was secure, so it was worth the effort.

What You Should Include in Hipaa Compliant Hosting​

• Strong Data Encryption
• Frequent and secure Backups
• Access Controls
• Audit Logs
• A signed BAA (Business Associate Agreement)

Have you ever noticed how many questions health applications ask regarding your security? That's Hipaa!

What PCI DSS Means for Hosting​

PCI DSS is designed to protect credit card payment data. When you accept credit card payments through your website, you must also comply with PCI DSS, no exceptions. I once assisted with a website that accepted credit card payments, and I felt like PCI DSS was the "strict instructor" of the hosting industry. Nonetheless, PCI DSS was beneficial!

To comply with PCI DSS, hosting needs to offer the following items:

• Firewalls
• Encryption of credit card data
• No storage of any sensitive credit card data
• Strong antivirus protection
• Regularly conduct security audits on your hosting environment

Have you ever been worried about whether your credit card was safe when you typed in your number? That's essentially what PCI DSS is going to help to protect.

What is the Difference Between HIPAA and PCI DSS?​

To make this very easy to understand:

• HIPAA = Medical Information; and
• PCI DSS = Credit Card Payment Information

Both require:

• Strong Security
• Safe storage of data
• Strictly controlled access

However, while both HIPAA and PCI DSS provide protection for two very different types of sensitive data, the two do offer the same protection.

Reasons To Be Concerned​

You may ask yourself if this applies to you. If you have a website that collects health-related information or takes credit card transactions, the answer is yes. If you do not follow these regulations your business may face serious consequences. No one wants to deal with being taken to court.