How do I store protected health information (PHI) in Catalyst Data Store and Stratus in a HIPAA-compliant way?

Turn on the PII/ePHI controls in each component that holds the data, and limit who can see it.

1. In Catalyst CloudScale Data Store, enable the PII/ePHI validator on each column that holds PHI, when you create the column or by editing it later. For long-form protected text, use the Encrypted text data type. Only Admins and project members with the required permissions can view data in these columns.
2. In CloudScale Stratus, open the bucket’s Configurations tab, expand General Settings, and enable PII/ePHI, and Data Encryption if you need it. Every access to the bucket’s objects is then logged.
3. In Settings → Profiles & Permissions, grant access to Data Store, Logs and Audit Logs only to the profiles that need it.
4. Review Settings → Audit Logs → Application Logs, which records each creation, update and deletion of rows in PII/ePHI columns and the activity on PII/ePHI buckets. The console shows the last year, and Admins can click Export Logs to download up to six years.

Note: Stratus bucket settings are off by default, so enable them before you upload PHI.

Refer to the HIPAA Compliance help page for details.