Skip to content

Commit 7758b36

Browse files
awatson1978awatson1978
committed
initial commit
0 parents  commit 7758b36

File tree

64 files changed

+3895
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+3895
-0
lines changed

‎README.md

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
## clinical:hipaa
2+
3+
HIPAA Compliance for Meteor Apps. Meta package containing audit log, user accounts, and ssl security.
4+
5+
#### Installation
6+
7+
``meteor add clinical:hipaa``
8+
9+
#### Packages
10+
11+
This is a meta package, and includes the following sub-packages:
12+
13+
````bash
14+
# for private PHI
15+
[accounts-base](https://atmospherejs.com/meteor/accounts-base)
16+
[accounts-password](https://atmospherejs.com/meteor/accounts-password)
17+
18+
# for auditing PHI access
19+
clinical:hipaa-audit-log
20+
21+
# for secure transmission of PHI
22+
[force-ssl](https://atmospherejs.com/meteor/force-ssl)
23+
````
24+
25+
We're currently in the process of adding at-rest disk encryption for secure PHI at rest.
26+
27+
#### API
28+
29+
````html
30+
{{> thirdPartyPolicy}}
31+
{{> approvedToolsPolicy}}
32+
{{> auditingPolicy}}
33+
{{> breachPolicy}}
34+
{{> configurationManagementPolicy}}
35+
{{> dataIntegrityPolicy}}
36+
{{> dataManagementPolicy}}
37+
{{> dataRetentionPolicy}}
38+
{{> disasterRecoveryPolicy}}
39+
{{> disposableMediaPolicy}}
40+
{{> employeesPolicy}}
41+
{{> facilityAccessPolicy}}
42+
{{> hipaaBusinessAssociateAgreement}}
43+
{{> hipaaInheritanceForPaasCustomers}}
44+
{{> hipaaInheritanceForPlatformAddOnCustomers}}
45+
{{> hipaaMappingToCatalyzeControls}}
46+
{{> idsPolicy}}
47+
{{> incidentResponsePolicy}}
48+
{{> keyDefinitions}}
49+
{{> policyManagementPolicy}}
50+
{{> riskManagementPolicy}}
51+
{{> rolesPolicy}}
52+
{{> systemAccessPolicy}}
53+
{{> vulnerabilityScanningPolicy}}
54+
````
55+
56+
Of course, any of these templates can be included in a route using Iron Router or Flux Router.

‎hipaa-tests.js

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
// Write your tests here!
2+
// Here is an example.
3+
Tinytest.add('example', function (test) {
4+
test.equal(true, true);
5+
});

‎hipaa.js

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
// Write your package code here!

‎lib/client-helpers.js

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Session.setDefault("companyName", "ACME, Inc.");
2+
3+
4+
Template.registerHelper("companyName", function(argument){
5+
return Session.get("companyName");
6+
});

‎lib/hipaa.js

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Hipaa = {
2+
configure: function(options){
3+
if(Meteor.isClient){
4+
if(options.company){
5+
Session.set("companyName", options.company);
6+
}
7+
}
8+
}
9+
}

‎package.js

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
Package.describe({
2+
name: 'clinical:hipaa',
3+
version: '0.0.2',
4+
// Brief, one-line summary of the package.
5+
summary: 'HIPAA Compliance for Meteor Apps. Audit log, user accounts, and SSL security.',
6+
// URL to the Git repository containing the source code for this package.
7+
git: 'https://github.com/awatson1978/clinical-hipaa',
8+
// By default, Meteor will default to using README.md for documentation.
9+
// To avoid submitting documentation, set this field to null.
10+
documentation: 'README.md'
11+
});
12+
13+
Package.onUse(function(api) {
14+
api.versionsFrom('1.1.0.2');
15+
16+
api.use('meteor-platform');
17+
18+
api.use('accounts-base');
19+
api.use('accounts-password');
20+
api.use('force-ssl');
21+
api.use('clinical:[email protected]');
22+
api.use('perak:[email protected]')
23+
//api.use('session');
24+
25+
api.addFiles('lib/hipaa.js');
26+
api.addFiles('lib/client-helpers.js', 'client');
27+
28+
29+
api.addFiles('policyTemplates/3rd_party_policy.html');
30+
api.addFiles('policyTemplates/approved_tools_policy.html');
31+
api.addFiles('policyTemplates/auditing_policy.html');
32+
api.addFiles('policyTemplates/breach_policy.html');
33+
api.addFiles('policyTemplates/configuration_management_policy.html');
34+
api.addFiles('policyTemplates/data_integrity_policy.html');
35+
api.addFiles('policyTemplates/data_management_policy.html');
36+
api.addFiles('policyTemplates/data_retention_policy.html');
37+
api.addFiles('policyTemplates/disaster_recovery_policy.html');
38+
api.addFiles('policyTemplates/disposable_media_policy.html');
39+
api.addFiles('policyTemplates/employees_policy.html');
40+
api.addFiles('policyTemplates/facility_access_policy.html');
41+
api.addFiles('policyTemplates/hipaa_business_associate_agreement.html');
42+
api.addFiles('policyTemplates/hipaa_inheritance_for_paas_customers.html');
43+
api.addFiles('policyTemplates/hipaa_inheritance_for_platform_addon_customers.html');
44+
api.addFiles('policyTemplates/hipaa_mapping_to_catalyze_controls.html');
45+
api.addFiles('policyTemplates/ids_policy.html');
46+
api.addFiles('policyTemplates/incident_response_policy.html');
47+
api.addFiles('policyTemplates/key_definitions.html');
48+
api.addFiles('policyTemplates/policy_management_policy.html');
49+
api.addFiles('policyTemplates/risk_management_policy.html');
50+
api.addFiles('policyTemplates/roles_policy.html');
51+
api.addFiles('policyTemplates/systems_access_policy.html');
52+
api.addFiles('policyTemplates/vulnerability_scanning_policy.html');
53+
54+
api.export('thirdPartyPolicy');
55+
api.export('approvedToolsPolicy');
56+
api.export('auditingPolicy');
57+
api.export('breachPolicy');
58+
api.export('configurationManagementPolicy');
59+
api.export('dataIntegrityPolicy');
60+
api.export('dataManagementPolicy');
61+
api.export('dataRetentionPolicy');
62+
api.export('disasterRecoveryPolicy');
63+
api.export('disposableMediaPolicy');
64+
api.export('employeesPolicy');
65+
api.export('facilityAccessPolicy');
66+
api.export('hipaaBusinessAssociateAgreement');
67+
api.export('hipaaInheritanceForPaasCustomers');
68+
api.export('hipaaInheritanceForPlatformAddOnCustomers');
69+
api.export('hipaaMappingToCatalyzeControls');
70+
api.export('idsPolicy');
71+
api.export('incidentResponsePolicy');
72+
api.export('keyDefinitions');
73+
api.export('policyManagementPolicy');
74+
api.export('riskManagementPolicy');
75+
api.export('rolesPolicy');
76+
api.export('systemAccessPolicy');
77+
api.export('vulnerabilityScanningPolicy');
78+
79+
});
80+
81+
Package.onTest(function(api) {
82+
api.use('tinytest');
83+
api.use('clinical:hipaa');
84+
api.addFiles('hipaa-tests.js');
85+
});

‎policies/.gitignore

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
### OSX ###
2+
.DS_Store
3+
.AppleDouble
4+
.LSOverride
5+
6+
# Icon must end with two \r
7+
Icon
8+
9+
10+
# Thumbnails
11+
._*
12+
13+
# Files that might appear on external disk
14+
.Spotlight-V100
15+
.Trashes
16+
17+
# Directories potentially created on remote AFP share
18+
.AppleDB
19+
.AppleDesktop
20+
Network Trash Folder
21+
Temporary Items
22+
.apdisk
23+
24+
25+
### Ruby ###
26+
*.gem
27+
*.rbc
28+
/.config
29+
/coverage/
30+
/InstalledFiles
31+
/pkg/
32+
/spec/reports/
33+
/test/tmp/
34+
/test/version_tmp/
35+
/tmp/
36+
37+
## Specific to RubyMotion:
38+
.dat*
39+
.repl_history
40+
build/
41+
42+
## Documentation cache and generated files:
43+
/.yardoc/
44+
/_yardoc/
45+
/doc/
46+
/rdoc/
47+
48+
## Environment normalisation:
49+
/.bundle/
50+
/vendor/bundle
51+
/lib/bundler/man/
52+
53+
# for a library or gem, you might want to ignore these files since the code is
54+
# intended to run in multiple environments; otherwise, check them in:
55+
# Gemfile.lock
56+
# .ruby-version
57+
# .ruby-gemset
58+
59+
# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
60+
.rvmrc

‎policies/3rd_party_policy.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
3+
# 3rd Party Policy
4+
5+
Catalyze makes every effort to assure all 3rd party organizations are compliant and do not compromise the integrity, security, and privacy of Catalyze or Catalyze Customer data. 3rd Parties include Customers, Partners, Subcontractors, and Contracted Developers.
6+
7+
## Applicable Standards from the HITRUST Common Security Framework
8+
9+
* 05.i - Identification of Risks Related to External Parties
10+
* 05.k - Addressing Security in Third Party Agreements
11+
* 09.e - Service Delivery
12+
* 09.f - Monitoring and Review of Third Party Services
13+
* 09.g - Managing Changes to Third Party Services
14+
* 10.1 - Outsourced Software Development
15+
16+
## Applicable Standards from the HIPAA Security Rule
17+
18+
* 164.314(a)(1)(i) - Business Associate Contracts or Other Arrangements
19+
20+
## Policies to Assure 3rd Parties Support Catalyze Compliance
21+
22+
1. The following steps are required before 3rd parties are granted access to any Catalyze systems:
23+
* Due diligence with the 3rd party;
24+
* Controls implemented to maintain compliance;
25+
* Written agreements, with appropriate security requirements, are executed.
26+
2. All connections and data in transit between the Catalyze Platform and 3rd parties are encrypted end to end.
27+
3. Access granted to external parties is limited to the minimum necessary and granted only for the duration required.
28+
4. A standard business associate agreement with Customers and Partners is defined and includes the required security controls in accordance with the organization’s security policies. Additionally, responsibility is assigned in these agreements.
29+
5. Catalyze has Service Level Agreements (SLAs) with Subcontractors with an agreed service arrangement addressing liability, service definitions, security controls, and aspects of services management.
30+
* Catalyze utilizes monitoring tools to regularly evaluate Subcontractors against relevant SLAs.
31+
7. Third parties are unable to make changes to any Catalyze infrastructure without explicit permission from Catalyze. Additionally, no Catalyze Customers or Partners have access outside of their own environment, meaning they cannot access, modify, or delete anything related to other 3rd parties.
32+
8. Whenever outsourced development is utilized by Catalyze, all changes to production systems will be approved and implemented by Catalyze workforce members only. All outsourced development requires a formal contract with Catalyze.
33+
9. Catalyze maintains and annually reviews a list all current Partners and Subcontractors.
34+
10. Catalyze assesses security requirements and compliance considerations with all Partners and Subcontracts.
35+
11. Regular review is conducted as required by SLAs to assure security and compliance. These reviews include reports, audit trails, security events, operational issues, failures and disruptions, and identified issues are investigated and resolved in a reasonable and timely manner.
36+
13. Any changes to Partner and Subcontractor services and systems are reviewed before implementation.
37+
14. For all partners, Catalyze reviews activity annually to assure partners are in line with SLAs in contracts with Catalyze.

‎policies/CONTRIBUTING.md

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#Contributing
2+
3+
We encourage contributions to our open source policies. Here's a quick guide on how to contribute:
4+
5+
- Fork this repository so you have a copy on your personal Github account
6+
- Clone the forked repository (`git clone [email protected]:USERNAME/policies.git`)
7+
- Make your changes on a new branch
8+
- Commit and push your changes up to your fork
9+
- Create a PR with the green PR button basing from Catalyze's policies repository
10+
11+
Once you've created the PR we'll receive a notification for review. If the changes make sense we'll approve and merge them in.

‎policies/README.md

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Catalyze HIPAA Compliance Policies
2+
3+
HIPAA compliance is complicated, but it doesn't have to be. Catalyze helps relieve the technical burden with our HIPAA-compliant cloud computing platform and solutions for healthcare.
4+
5+
In an effort to make compliance as easy as possible for companies working with protected health information (PHI), we decided to open source our company policies.
6+
7+
Our policies have been written with modern, cloud-based technology vendors in mind. We looked far and wide for policy examples that fit our company, and couldn't find any. So we wrote our own. Importantly, these policies have been through three external audits—two HIPAA audits and one HITRUST audit.
8+
9+
Do you handle PHI and not yet have your own company policies in place? Then you'll find our content useful.
10+
11+
## Why did we open source these policies?
12+
13+
HIPAA compliance really has two halves. The first half includes all technical guidelines, both physical and digital. Compliant companies take measures to secure their hardware and manage their software in a certain way. Encryption, logging, monitoring—these are just a few examples of HIPAA technical requirements. Catalyze builds its platform with these guidelines in mind.
14+
15+
The second half of HIPAA is focused on administrative and organizational activities. This includes signing Business Associate Agreements (BAAs), and managing company policies like training, among other things. Crafting company policies that align with HIPAA administrative guidelines are straightforward, but an immense burden.
16+
17+
When we were creating our policies, we found lots of policy templates for healthcare providers, but nothing for modern health technology companies. We spent a lot of time and effort writing our policies, then adapting them to meet the demands of external audits. We don't want people to reinvent the wheel; trust us, it's not fun. We also feel a broader community can improve these polices over time, making them better for everybody.
18+
19+
By open sourcing our own company policies, we hope other companies who handle PHI will benefit. It aligns with our company mission: to help you focus on building innovative healthcare applications.
20+
21+
## What do I do with these policies?
22+
23+
As a company who handles PHI, it's critical you maintain and publish your own policies. To make use of our policies, we recommend the following steps.
24+
25+
1. Read through all the enclosed policies to get an understanding to the structure.
26+
2. When ready, download the policies and comb through for mentions of Catalyze or our business and change to appropriate references to your company.
27+
3. Publish your policies in a publicly available location. The files are markdown, so you may need to convert to HTML if you don't have a publishing platform capable of markdown format. You can either create an index page linking to each individual policy, or create a single page listing all the policies in line, [much like we did](https://catalyze.io/policy/).
28+
29+
## Who is behind this?
30+
31+
[Catalyze.io](htts://catalyze.io), healthcare's trusted HIPAA-compliant platform.
32+
33+
We help companies who handle PHI, both business associates and covered entities, maintain compliance with our Platform as a Service, Mobile Backend as a Service, and managed data integration services. Think Heroku and Parse for healthcare. In addition, we also provide HL7 Integration for those who need to communicate with EHR vendors like Epic or Cerner.
34+
35+
To get in touch, shoot us an email at [[email protected]](mailto:[email protected]). We'd love to hear from you!
36+
37+
### License
38+
39+
All policies are licensed under [CC BY-SA 4.0](http://creativecommons.org/licenses/by-sa/4.0/).
40+
41+
### Policy Index
42+
43+
Each policy is included as it's own markdown file in case you want to cherry pick specific policies. If you currently have no policies in place, we encourage you to consider utilizing all policies.
44+
45+
* [Introduction](introduction.md)
46+
* [HIPAA Inheritance for PaaS Customers](hipaa_inheritance_for_paas_customers.md)
47+
* [HIPAA Inheritance for Platform Add-on Customers](hipaa_inheritance_for_platform_addon_customers.md)
48+
* [Policy Management Policy](policy_management_policy.md)
49+
* [Risk Management Policy](risk_management_policy.md)
50+
* [Roles Policy](roles_policy.md)
51+
* [Data Management Policy](data_management_policy.md)
52+
* [System Access Policy](systems_access_policy.md)
53+
* [Auditing Policy](auditing_policy.md)
54+
* [Configuration Management Policy](configuration_management_policy.md)
55+
* [Facility Access Policy](facility_access_policy.md)
56+
* [Incident Response Policy](incident_response_policy.md)
57+
* [Breach Policy](breach_policy.md)
58+
* [Disaster Recover Policy](disaster_recovery_policy.md)
59+
* [Disposable Media Policy](disposable_media_policy.md)
60+
* [IDS Policy](ids_policy.md)
61+
* [Vulnerability Scanning Policy](vulnerability_scanning_policy.md)
62+
* [Data Integrity Policy](data_integrity_policy.md)
63+
* [Data Retention Policy](data_retention_policy.md)
64+
* [Employees Policy](employees_policy.md)
65+
* [Approved Tools Policy](approved_tools_policy.md)
66+
* [3rd Party Policy](3rd_party_policy.md)
67+
* [Key Definitions](key_definitions.md)
68+
* [Catalyze HIPAA Business Associate Agreement (“BAA”)](catalyze_hipaa_business_associate_agreement.md)
69+
* [HIPAA Mappings to Catalyze Controls](hipaa_mapping_to_catalyze_controls.md)
70+
71+
72+

‎policies/approved_tools_policy.md

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Approved Tools Policy
2+
3+
Catalyze utilizes a suite of approved software tools for internal use by workforce members. These software tools are either self-hosted, with security managed by Catalyze, or they are hosted by a Subcontractor with appropriate business associate agreements in place to preserve data integrity. Use of other tools requires approval from Catalyze leadership.
4+
5+
## List of Approved Tools
6+
7+
* **Gitlab**. Gitlab is an open source tool built on top of Git, the version control platform. Gitlab is hosted and secured by Catalyze. It is utilized for storage of configuration scripts and other infrastructure automation tools, as well as for source and version control of application code used by Catalyze.
8+
9+
* **Box**. Box is used for storage of files and sharing of files with Partners and Customers.
10+
11+
* **Google Apps**. Google Apps is used for email and document collaboration.

0 commit comments

Comments
 (0)