Description

Ensure that no Render workflows are created in a workspace that has HIPAA enabled. Render workflows cannot run on HIPAA-compliant hosts, so they must not be used to process protected health information (PHI).

Rationale

A HIPAA-enabled workspace is meant to keep all protected health information on access-restricted, compliant hosts. Workflows run outside those hosts, so using them in a HIPAA workspace could move PHI to infrastructure that is not covered, creating a compliance violation.

Impact

  • Protected health information stays on HIPAA-compliant hosts

  • Avoids HIPAA compliance violations

  • Workflow tasks must be moved to another service type or workspace

Default Value

Workflows can be created in any workspace unless the organization prevents it.

Pre-Requisites

  • Workspace Admin role

  • Knowledge of which workspaces are HIPAA-enabled

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Switch to each HIPAA-enabled workspace and open its workflows list from the workspace home.

  3. If any workflow exists in a HIPAA-enabled workspace, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Move the workflow's logic into a supported service type in the HIPAA workspace (such as a background worker or cron job), or into a separate non-HIPAA workspace that never handles PHI.

  3. Delete the workflow from the HIPAA-enabled workspace from its Settings page.

Backout Plan

  1. Re-create the workflow only in a non-HIPAA workspace that does not process protected health information.

Reference