HIPAA 合规性和 Supabase

健康保险可携性与责任法案（HIPAA）是一部全面的法律，既保护个人的健康信息，又确保健康保险覆盖的连续性。它为所有处理受保护健康信息（PHI）——也称为电子PHI（ePHI）——的机构制定了隐私和安全标准。HIPAA 是美国特有的，但很多国家也有类似的法律，或者已经在立法过程中。

🌐 The Health Insurance Portability and Accountability Act (HIPAA) is a comprehensive law that protects individuals' health information while ensuring the continuity of health insurance coverage. It sets standards for privacy and security that must be followed by all entities that handle Protected Health Information (PHI), also known as electronic PHI (ePHI). HIPAA is specific to the United States, however many countries have similar or laws already in place or under legislation.

根据 HIPAA，受保护实体和业务伙伴都有明确的责任来确保保护 PHI（受保护健康信息）。Supabase 作为业务伙伴，为希望提供医疗相关服务的客户（受保护实体）提供支持。作为业务伙伴，Supabase 有许多义务，并且已经接受了对现有安全和隐私控制的审计，以确保符合这些要求。Supabase 与所有可能接触到电子 PHI（如 AWS）的供应商签署了业务伙伴协议（BAA），并确保遵守协议中的条款。同样，当客户与我们签署 BAA 时，他们在使用 Supabase 存储 PHI 时也有一些需要遵守的责任。

🌐 Under HIPAA, both covered entities and business associates have distinct responsibilities to ensure the protection of PHI. Supabase acts as a business associate for customers (the covered entity) who wish to provide healthcare related services. As a business associate, Supabase has a number of obligations and has undergone auditing of the security and privacy controls that are in place to meet these. Supabase has signed a Business Associate Agreement (BAA) with all of our vendors who would have access to ePHI, such as AWS, and ensure that we follow their terms listed in the agreements. Similarly when a customer signs a BAA with us, they have some responsibilities they agree to when using Supabase to store PHI.

托管的 Supabase 平台具备满足 HIPAA 要求所需的控制措施。而这些控制措施在自托管的 Supabase 中并不是开箱即用的。HIPAA 控制不仅仅限于 Supabase 产品，还包括与服务提供商的法律协议（BAA）、操作控制和政策。使用自托管 Supabase 实现 HIPAA 合规超出了本文档的范围，你应该咨询你的审计师以获得进一步指导。

🌐 The hosted Supabase platform has the necessary controls to meet HIPAA requirements. These controls are not supported out of the box in self-hosted Supabase. HIPAA controls extend further than the Supabase product, encompassing legal agreements (BAAs) with providers, operating controls and policies. Achieving HIPAA compliance with self-hosted Supabase is out of scope for this documentation and you should consult your auditor for further guidance.

客户的责任 #

🌐 Customer responsibilities

受保护实体（客户）是直接处理受保护健康信息（PHI）的组织，比如健康保险计划、医疗信息交换中心，以及进行某些电子交易的医疗服务提供者。

🌐 Covered entities (the customer) are organizations that directly handle PHI, such as health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions.

遵守 HIPAA 规则：受保护实体必须遵守 HIPAA 隐私规则、安全规则和违规通知规则，以保护电子受保护健康信息（ePHI）的隐私和安全。
商业伙伴协议 (BAAs)：客户必须与 Supabase 签署 BAA。当被覆盖实体聘请商业伙伴来协助开展其医疗活动时，必须有书面 BAA。该协议概述了商业伙伴的责任，并要求他们遵守 HIPAA 规则。
内部合规计划：客户必须配置他们的 HIPAA 项目，并遵循安全顾问提供的指导。受保护实体负责实现内部流程和合规计划，以确保他们符合 HIPAA 要求。

Supabase 的职责 #

🌐 Supabase responsibilities

Supabase 作为业务合作伙伴，以及 Supabase 使用的供应商，都是代表客户执行功能或活动的实体。

🌐 Supabase as the business associate, and the vendors used by Supabase, are the entities that perform functions or activities on behalf of the customer.

直接责任：Supabase 对遵守 HIPAA 规则的某些条款负有直接责任。这意味着 Supabase 需要实现保障措施来保护 ePHI，并向客户报告违规行为。
遵守BAA：Supabase必须遵守BAA的条款，包括实现适当的管理、物理和技术保护措施来保护ePHI。
供应商管理：Supabase 还必须确保我们的供应商（可能有权访问电子受保护健康信息 ePHI）遵守 HIPAA 规则。这是通过与每个供应商签署 BAA 来实现的。

保持合规与安全 #

🌐 Staying compliant and secure

合规是一个持续的过程，不应被视为一次性的控制审计。Supabase 在审计时会应用所有必要的隐私和安全控制来确保符合 HIPAA，但同时也设置了额外的检查和监控，以确保这些控制在审计期间不会被禁用或更改。客户在他们的 HIPAA 环境中也需承诺做到同样的事情。Supabase 提供了不断增加的检查项，用于提醒客户项目中可能会禁用或削弱 HIPAA 必需控制的变更。客户会通过安全顾问收到警告和指导，但应用推荐控制的责任完全由客户自己承担。

🌐 Compliance is a continuous process and should not be treated as a point-in-time audit of controls. Supabase applies all the necessary privacy and security controls to ensure HIPAA compliance at audit time, but also has additional checks and monitoring in place to ensure those controls are not disabled or altered in between audit periods. Customers commit to doing the same in their HIPAA environments. Supabase provides a growing set of checks that warn customers of changes to their projects that disable or weaken HIPAA required controls. Customers will receive warnings and guidance via the Security Advisor, however the responsibility of applying the recommended controls falls directly to the customer.

我们的共享责任模型文档讨论了 HIPAA 和一般数据管理的最佳实践，这种责任是如何在客户和 Supabase 之间共享的，以及如何保持合规。

🌐 Our shared responsibility model document discusses both HIPAA and general data management best practices, how this responsibility is shared between customers and Supabase, and how to stay compliant.

常见问题 #

🌐 Frequently asked questions

SOC 2 和 HIPAA 有什么区别？

两者都是保护敏感数据的框架，不过它们的目的不同。它们共享许多安全和隐私控制，通常满足其中一个的控制要求意味着接近符合另一个的要求。

🌐 Both are frameworks for protecting sensitive data, however they serve two different purposes. They share many security and privacy controls and meeting the controls of one normally means being close to complying with the other.

主要的区别归结于目的和范围。

🌐 The main differentiator comes down to purpose and scope.

SOC 2 并不是针对特定行业的，它可以适用于任何处理客户数据的服务机构。
HIPAA 是美国的一项联邦法规。HIPAA 为 PHI/ePHI 的隐私和安全设定了标准，确保患者数据被机密和安全地处理。

Supabase 的 HIPAA 环境也符合 SOC 2 吗？

是的。Supabase 对所有环境都实现相同的 SOC 2 控制措施，并且对 HIPAA 环境还会增加额外的控制措施。

🌐 Yes. Supabase applies the same SOC 2 controls to all environments, with additional controls being applied to HIPAA environments.

Supabase 默认会记录数据库连接吗？

不。Supabase 默认会将新项目的 Postgres log_connections 设置为关闭。HIPAA 和高合规性项目应保持连接日志开启。如果关闭，安全顾问会发出警告。

🌐 No. Supabase sets Postgres log_connections to off by default for new projects. HIPAA and high-compliance projects should keep connection logging enabled. The Security Advisor warns if it is disabled.

Supabase多久审计一次？

Supabase 会进行年度审计。HIPAA 控制与 SOC 2 控制在同一审计周期内进行审计。

🌐 Supabase undergoes annual audits. The HIPAA controls are audited during the same audit period as the SOC 2 controls.

资源 #

🌐 Resources