1. ALERTLOGIC.COM / U.S. 877.484.8383 / U.K. +44 (0) 203 011 5533
HIPAA COMPLIANCE: A CHEAT SHEET
SELECTING TECHNOLOGIES FOR
Selecting technologies to help your organization comply with HIPAA regulations can be overwhelming. Here are few
things you should look for when evaluating technologies against your HIPAA requirements.
INTRUSION DETECTION SYSTEM (IDS)
Intrusion detection systems run the gamut from complex host-based detection to lightweight network-based detection.
Generally, any credible IDS will provide core functionality designed to detect known bad activity based on known
signatures. To comply with the administrative and technical HIPAA safeguards — and to protect your network —be sure
to ask the following questions:
WEB APPLICATION PROTECTION
Hackers and cybercriminals are exploiting poorly protected websites at an alarming rate. Organizations are impacted
almost daily. An excellent way to protect your internet-facing websites and applications is to implement a Web
Application Firewall (WAF). Depending on your deployment preference, the WAF can provide inline protection from
invalid/malformed requests made against your website or simply monitor web requests, alerting when these bad
requests are encountered. While WAFs are a critical component of your security framework, they also assist you in
complying the specific administrative safeguards related to HIPAA. During your evaluation, find out the following:
01 Do you provide signatures of known bad and known good files/network traffic?
02 How often are your signatures updated? Do I have to update them myself or is the system auto-updating?
03 How much training does someone need to become proficient in your solution?
04 Is your IDS integrated with any other security technology?
05 Will your IDS work in both my on-premises data center and my cloud environments?
01 Who manages the Web Application Firewall?
02 How does your WAF handle changes made to my website? Do I have to reconfigure the solution myself?
03 What website attack vectors is your WAF blocking?
04 Can your WAF work across my different public cloud hosting providers?
05 How quickly can your WAF be implemented and start protecting my environment?

2. SELECTING TECHNOLOGIES FOR HIPAA COMPLIANCE: A CHEAT SHEET
© 2015 Alert Logic, Inc. All rights reserved. Alert Logic and the Alert Logic logo are trademarks, registered trademarks, or
servicemarks of Alert Logic, Inc. All other trademarks listed in this document are the property of their respective owners.
ABOUT ALERT LOGIC
Alert Logic, the leader in security and compliance solutions for the cloud, provides Security-as-a-Service for on-premises,
cloud, and hybrid infrastructures, delivering deep security insight and continuous protection for customers at a lower cost
than traditional security solutions. Fully managed by a team of experts, the Alert Logic Security-as-a-Service solution provides
network, system and web application protection immediately, wherever your IT infrastructure resides. Alert Logic partners with
the leading cloud platforms and hosting providers to protect over 3,500 organizations worldwide. Built for cloud scale, our
patented platform stores petabytes of data, analyses over 400 million events and identifies over 50,000 security incidents each
month, which are managed by our 24x7 Security Operations Center. Alert Logic, founded in 2002, is headquartered in Houston,
Texas, with offices in Seattle, Dallas, Cardiff, Belfast and London. For more information, please visit www.alertlogic.com.
LOG MANAGEMENT
By far, log management solutions provide the broadest coverage in regards to your HIPAA mandates. Log management
solutions vary in complexity and deployment models. There are a myriad of solutions that provide complex query
languages that enable skilled users to mine logs for indicators of compromise, as well as any activity that may indicate a
HIPAA mandate may have been broken. For those not well-versed in log analysis, there are highly automated solutions
that enable users to easily produce reports, search logs, and comply with audit requests without significant training.
Selection of a log management solution should be driven not only by HIPAA requirements but also by your ability to
manage the day-to-day usage of the solution. Ask these questions when looking for a log management solution:
01 Does your solution have the ability to archive log data long term? Where are the logs stored?
02 How do I search collected logs? Is there a proprietary query language I would have to learn?
03
Where is your solution deployed? How often is the solution updated? Are there additional costs
associated with upgrading when a new version is released?
04 Does your solution include pre-built HIPAA reports? If not, how hard is it to make them?
05 I have a hybrid environment. Will your single solution work for all my environments?
To learn more about how Alert Logic Security-as-a-Service solutions can help meet your HIPAA compliance needs visit:
www.alertlogic.com/solutions/compliance/hipaa-hitech-compliance