Azure SQL Managed Instance and HIPAA

Question

We are currently developing a mobile app for a healthcare product. We are using MS SQL Server Managed Instance for our development and testing.

I would like to understand and need inputs, references and help on below aspects:

Given a region deployed - e.g., US-East

1. How do I enforce SQL Managed instance not to backup or replicate databases to other region?
2. What instructions or BAA should we inform Microsoft not to move data out of a requested region ?

Thank you

Answer 1

Hi @SaravanakumarM-1014 - Microsoft Azure has full support for HIPPA regulatory compliance (see: Microsoft releases automation for HIPAA/HITRUST compliance), and the best way to ensure that your Azure deployments stay compliant is to leverage Azure Blue Prints: Azure Security and Compliance Blueprint for HIPAA/HITRUST – Health Data & AI

As for concerns that Azure doesn't replicate/copy/store data in another region, you have the control of your deployment to locate services in specific regions but, this doesn't protect your deployment/solution from accidental actions that may cause an occurrence where data is written to or stored somewhere outside of policy. This is why the Azure Blueprints functionality is key to ensuring you are compliant at all times.

The blueprint sample helps customers deploy a core set of policies for any Azure-deployed architecture requiring accreditation or compliance with the HITRUST HIPAA framework. The control mapping section provides details on policies included within this initiative and how these policies help meet various controls defined by HITRUST HIPAA framework. When assigned to an architecture, resources are evaluated by Azure Policy for compliance with assigned policies.

Please let me know if you have any additional questions.

Regards,
Mike