Subject Area: Architecture
Level of complexity: Advanced
Approximate Time to complete: 30 minutes
Companion Workbook (twbx): n/a
Additional Resources on the web:
Is Tableau Hipaa compliant? The short answer: not out of the box, but it can be. Since Tableau itself is not a database and merely a reporting and query tool, is compliancy is contingent on the end user and database governance. This means that if the database you are pulling the information from is Hipaa compliant and the user has followed hippa compliant actions, then Tableau is Hipaa compliant. However, the issues of compliancy come down to the end user and the data governance of the database it is connecting to. A database could be Hipaa compliant but if the end user is able to pull information off the database through poor data governance then it would no long be Hipaa compliant. This change is dependent on the end user on what they choose to query and what the data administrator allows them to pull. A failure at either level of data query, database or user, breaks the Hipaa compliancy.
Besides ensuring compliancy at the database level and human error, Tableau allows a number of security features to maintain Hipaa compliancy.
1. Create a user filter to ensure row level data security. User filters allow users only to see the data associated with their permission at a row level. Tableau allows you to use a dimension to create these filters and apply them to the security permission. For more information, refer to this article: http://kb.tableau.com/articles/knowledgebase/row-level-security-and-user-filters
2. Hide dimensions/columns in a data extract. By excluding dimensions in Tableau Desktop is helpful in cleaning out the data source of information that should not be seen by the user or is sensitive. Excluding a column also increases performance and makes sure that only releveant data is given to the end user. http://kb.tableau.com/articles/knowledgebase/data-extracts-excluding-columns
3. Disabling "view underlying data" in a Tableau Server View. By disabling the view of the underlying data, the visualizations make the underlying data anonymous thus ensuring security. Administration of this feature is easily done through Tableau Desktop when publishing to Server. http://kb.tableau.com/articles/knowledgebase/data-extracts-excluding-columns
4. Restrict workbook downloading. Similar to restricting the view of underlying data, we can disable the download of workbooks and their data when publishing to Server. http://kb.tableau.com/articles/knowledgebase/data-extracts-excluding-columns
5. Use Tableau Server administrative views to see what information people are accessing. Tableau Desktop can be used to find out what information and views your users are accessing. Use the following link to learn how to customize your own administrative dashboard. http://onlinehelp.tableau.com/current/server/en-us/adminview.htm
To summarize, the best practices of maintaining Hipaa compliance making sure that your end users are accessing only the data they should be. Tableau offers a number of ways to easily manage this data goernance but ultimately it rests on the shoulder of the end user and the IT databased administrator to make sure that the Tableau is used Tableau compliant manner.