Self-hosted remote desktop for healthcare

Place the Guacamole gateway in a dedicated DMZ or access zone, with the clinical network reachable only through controlled, port-limited paths from that zone. Ask the partner to show the network diagram, which hosts the gateway can reach, and whether clinical workstations and medical device segments are kept out of reach of vendor sessions. Confirm how the design handles the clinical systems that hold ePHI, and who approves firewall rule changes. Ask whether the gateway can be patched and restarted without affecting clinical operations.

The partner should enforce MFA at the gateway for every session, with no direct path to the target hosts that bypasses it. Ask which identity provider and which Guacamole extension will be used, such as LDAP or Active Directory, SAML, OpenID Connect or Duo and TOTP, and how vendor accounts are separated from workforce accounts. Confirm that vendor identities are time-bound, individually named and disabled at contract end. The Security Rule addresses unique user identification at 45 CFR 164.312(a)(2)(i), so ask how each person is identified in logs.

Session recordings contain ePHI when a clinician or vendor views patient data, so they must be stored with the same access controls and encryption as the source systems. Ask where recordings are written, whether on-premises storage or an approved hospital archive, who can view them, and how retention is set per policy. Also ask how recordings are encrypted at rest and how deletion is performed when retention expires. Your own legal and records team should confirm retention periods, since HIPAA does not set a single retention duration for recordings.

Audit logs should be written to a store that the gateway administrators cannot silently edit, such as a central log server or write-once storage with restricted delete rights. Ask the partner how logs are forwarded, how time is synchronized across the gateway, database and log host, and who receives alerts when logs stop arriving. The audit control requirement at 45 CFR 164.312(b) requires recording and examining activity in systems that contain ePHI, so ask how reviews are scheduled and documented. Request a sample log entry for one session before signing the scope.

Emergency access should be a documented, tested procedure with a named break-glass account, stored credentials held under dual control, and an alert raised on every use. The HIPAA technical safeguards list an emergency access procedure as a required implementation specification under 45 CFR 164.312, so the partner should map it to a written runbook. Ask how the break-glass path is kept working when the identity provider is down, and whether it is covered by MFA or a separate hardware token. Confirm who approves its use and how each use is reviewed afterward.

Before any vendor connects, the covered entity should confirm that a business associate contract exists that meets the terms in 45 CFR 164.314(a)(2)(i), including compliance with the Security Rule, flow-down to subcontractors, and reporting of security incidents. Ask the partner to describe how its own staff are bound by those terms when they access ePHI during implementation. Ask whether the vendor support scope includes subcontractors and how their access is approved. Legal counsel should review the contract wording, since this is a compliance question rather than a technical one.

A credible pre-go-live test covers the MFA path, failed login handling, session recording, log delivery, network reachability from the DMZ, and the emergency access runbook. Ask whether the partner runs security testing against the gateway and its target access rules, and whether results are delivered in writing with a remediation plan. Confirm that the test plan is agreed in the fixed scope before work starts, and that a retest is included for critical findings. Ask for a copy of the test cases so your team can repeat them later. Remember that DeployOpen prepares evidence for assessments but does not issue audit reports or certifications.

The main cost drivers are the number of workstations and clinical endpoints in scope, how many identity sources the gateway must integrate with, how long session recordings are kept, how the DMZ and network segments are designed, and how much testing the design needs before go-live. Each driver scales differently. A pilot covering one clinical unit and a single directory is a much smaller engagement than a multi-site rollout across clinics, vendor-managed devices and imaging workstations. Ask any partner to show how each driver changes the written scope, so you can see which decisions move the quote most.

• Endpoint count and protocol mix (RDP, VNC, SSH) across departments
• Identity integration, including MFA and directory groups
• Recording volume and retention period under your own policy
• DMZ or segmented gateway placement and firewall change work
• Security testing scope for the gateway and connected systems

Design, installation, integration, hardening and documentation are one-time costs paid during the engagement. Recurring costs include the infrastructure that runs the gateway, storage for session recordings that grows with usage, patching and upgrades of the gateway and its database, log review, and periodic access reviews for clinicians and vendors. Guacamole itself is released under the Apache License, Version 2.0, so software licensing is not the usual recurring line item, but any extensions, MFA products or directory services you add carry their own terms. Confirm each recurring item with your team before signing, because recording storage and log review are the costs most often underestimated.

Many hospital IT teams can run the day-to-day operation once the platform is built, but building it correctly under the HIPAA Security Rule requires skills across network placement, identity, Linux hardening, database backups and audit logging. The Security Rule requires unique user identification and audit controls under 45 CFR 164.312, and these must be designed and evidenced, not just switched on. Assess whether your team has capacity for the initial build, the change control for clinical systems and the ongoing patching cadence. Many organizations split the work: internal staff own access decisions and operations, while an implementation partner builds, hardens and documents the platform.

The engagement needs a current asset inventory of clinical workstations and vendor-managed devices, named owners for the identity directory and MFA, input from clinical leads on which workflows must work remotely, and agreed change windows that avoid clinical peaks. You will also need network diagrams for the segments the gateway touches and a list of vendors who need access, with their support boundaries. Clinical workflow input matters because a session that drops during a chart review or imaging read creates a patient-facing problem, so the test plan should reflect real tasks rather than a generic login check.

DeployOpen works from a written scope that defines the systems in scope, the protocols, the identity integrations, the recording and retention requirements, the DMZ design, the hardening baseline, the testing included and the handover deliverables. Most engagements are fixed-scope, so the scope, deliverables and timelines are agreed in writing before work starts, and the quote follows from that scope. DeployOpen does not publish a price list. To get a comparable quote from any partner, ask for the same written scope, the list of assumptions about your environment and a clear split between one-time and recurring items.

No. There is no HIPAA certification, and HHS states that no Security Rule standard requires an entity to certify compliance. DeployOpen prepares systems, controls and evidence for compliance assessments, such as access records, audit logs and configuration documentation tied to 45 CFR 164.312. Independent auditors and certification bodies issue any audit reports or attestations. Ask a partner which evidence artifacts are included in the scope and which are your responsibility to collect and retain under your own policies.

Penalty exposure is not a line item in the project quote, but it is a reason to scope the controls carefully. For penalties assessed on or after January 28, 2026, the inflation-adjusted HIPAA civil money penalty ranges from $145 per violation to $2,190,294 per violation, with a calendar-year cap of $2,190,294 (45 CFR 102.3). Gaps in MFA, audit logging or vendor access are the kinds of findings that drive exposure, so the design work and testing scope should cover them. Your legal and compliance team should confirm how these figures apply to your organization.

Testing scope should cover the gateway, its authentication path, the protocol endpoints it reaches, and the session recording and logging pipeline. Security testing of applications and APIs, cloud and infrastructure, and access controls can be scoped as a separate deliverable. Ask whether the quote includes a penetration test of the gateway, a review of MFA enforcement and a test that audit records capture user identity and session activity. Confirm with your security team whether they require testing before connecting any vendor device.