APPLICATION OF HIPAA SECURITY RULE IN WORDPRESS
Can the Security Rule be Fulfilled for WooCommerce?
The answer is “conditionally yes”. Let’s take a step back thought, and explain what is going on with WooCommerce. This feature of WordPress which allows the creation of WordPress-based eCommerce platforms, is not HIPAA compliant, as it does not fulfill the Security Rule, making the HIPAA eCommerce platforms hosted by WordPress not agreeing with HIPAA compliance by default.
The reason for that is that business associates of the popular platform option are not HIPAA compliant, thus not allowing related entities to be compliant either. However, this does not mean that a healthcare-related eCommerce platform using WooCommerce cannot be rendered HIPAA compliant. The process to obey guidelines set by the Security Rule towards HIPAA compliance is long, requires some not straightforward steps and being constantly alert, but it is certainly applicable.
The first step to create a HIPAA eCommerce platform using WordPress and WooCommerce will be to conduct a risk assessment, as mentioned in the Security Rule safeguards, running a security scan and checking for vulnerabilities. All chosen plugins should be provided from trustworthy developers (if not WordPress) and updated regularly. Using security plugins is recommended, to reinforce data security.
Since ePHI should not be stored through WooCommerce or WordPress due to compliance issues, ePHI should be stored externally, using HIPAA-compliant data storage options that fulfill the guidelines as described earlier.
Having external data storage implies the need for an API to “connect” external with internal information. This means that an interface will have to be created on WordPress, where customers will be providing their ePHI on the platform, but data will be diverted and stored elsewhere. Data encryption and two-factor authentication for data access is also highly recommended for HIPAA-compliant online storage, as well as use of bulletproof passwords. Last but not least, a business associate agreement will have to be signed between the platform owner and providers of services that will handle ePHI (plugins, APIs).