Does SAS University Edition meet HIPPA requirements? What are security limitations?

[dmzrichard]

Hello, 

I am wondering how secure SAS University is for protected information. Is there a server that data is sent too and is that server secure? If there is no server, does it generate local copies on your computer? Is our data being stored anywhere besides a local copy or being pulled over to a non-secure site? 

Thanks. 

[ballardw]

---

@dmzrichard wrote:

Hello, 

I am wondering how secure SAS University is for protected information. Is there a server that data is sent too and is that server secure? If there is no server, does it generate local copies on your computer? Is our data being stored anywhere besides a local copy or being pulled over to a non-secure site? 

Thanks. 

---

Where the data resides, and how secure, will be somewhat up to your installation. In the basic (Display manager or Base SAS) stand alone version all the data resides where you tell it. If you send your output to a network location that is your instruction, and would be your responsibility to ensure compliance.

Enterprise Guide quite often uses a server but can run on a single machine using a Base SAS installation as the server. When the server is a different machine then it's security is the issue.

SAS Studio may have the same server connections as Enterprise Guide. So it would require knowing you installation storage security.

Data sets can be password protected but I don't know if that meets HIPPA standards.

The SAS on demand through Amazon as I understand it is pretty much not going to be HIPPA compliant. This is the only "cloud" defaulting version I am currently aware of.

Short answer: Maybe.

Longer answer: It can be with care.

[Reeza]

SAS UE runs locally via a VM, however, some information is sent back to SAS. I think it's primarily about what procs/tasks are being used and NOT any data. However, this does often mean data is stored locally on your machine, which often will violate HIPAA because the access controls are not set correctly. 

---

@dmzrichard wrote:

Hello, 

I am wondering how secure SAS University is for protected information. Is there a server that data is sent too and is that server secure? If there is no server, does it generate local copies on your computer? Is our data being stored anywhere besides a local copy or being pulled over to a non-secure site? 

Thanks. 

---