title: Heroku database and amazon s3 encryption key storage for HIPAA compliance
body: <p>I was hoping to get a recommendation on the best way to store a database encryption key for HIPAA compliance as well as Amazon S3 file storage security.  I have been searching stackoverflow and googling in general, but I just can't quite get a solid grasp whether what I'm <em>specifically</em> doing is sufficient.  I don't want something I'm doing differently from prescribed methods to make my app insecure.</p>
  
  <p>Currently, I have a Rails app that uses the gem attr_encrypted to encrypt sensitive patient identifying data in the database like name, ssn, address etc.  I also store things like images of signatures and patient pictures in Amazon S3 uses server side encryption.  I know I shouldn't hardcode the database encryption key in the application or in any file that might get verion controlled, but can I keep it in heroku's env config variables?  How are those secured?  How separate are they from the database (as in, if someone gets into heroku and steals a copy of the database, are the ENV variables vulnerable somehow as well?)?  I currently keep my AWS keys in heroku env variables, is that safe?  Also, what is the best pass phrase to use for the encryption?  I am currently using 2 sentences from a random page in a book I have.  </p>
  
  <p>Please let me know if I'm being terribly naive with any of the procedures I've outlined, and I apologize in advance if I am asking naive questions.  I'd like to be HIPAA compliant, but in addition I'd like piece of mind that I've gone beyond what HIPAA requires since from what I understand, HIPAA compliance does not always = actually secure.  </p>
  
  <p>Thanks everyone!</p>