Alas, the mere possibility of accidentally adding too much info into a help ticket by support staff alone is enough to have the company insist we use something else.
You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring.
Each record gets a UUID. Everywhere else you reference that record by UUID.
- Patient ABC123 called and requested modifications to their record
- Meds delivered to ABC123
- Insurance confirmed for patient ABC123
That’s how you ensure MINIMUM NECESSARY.
And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST:
https://www.hhs.gov/hipaa/for-professionals/security/nist-se...
For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)
HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them.
Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.