The Health Insurance Portability and Accountability Act (HIPAA) defines rules that American organizations must follow to securely handle and maintain Protected Health Information (PHI). To remain in compliance, organizations are required to have a signed Business Associate Agreement (BAA) from any partner organization that creates, receives, maintains, or transmits PHI. The partner must ensure that it will safeguard the PHI that passes through its systems. Businesses also have to meet a long checklist of compliance rules and practices.

Apache Superset is a cloud-native data exploration and visualization platform that businesses can use to create business intelligence reports and dashboards. It includes a state-of-the-art SQL IDE, and it's open source software, free of cost. The platform was originally developed at Airbnb and donated to the Apache Software Foundation.

You migrate PHI just as you would any other data, but you must stay cognizant of HIPAA regulations. No one but you and the data source can handle the data unless you have a BAA in place with them.

You can use any methods your data provider offers to extract data from their service. Many cloud-based data sources provide APIs that expose data to programmatic retrieval. Others allow you to set up webhooks to push event data to requesters. For data that lives in a database, you can use SELECT statements or a utility that does a mass dump of the data you specify.

You must replicate data from your SaaS applications to a data warehouse before you can report on it using Superset. Superset can connect to almost 30 databases and data warehouses. Once you choose a data source you want to connect to, you must specify a host name and port, database name, and username and password to get access to the data. You then specify the database schema or tables you want to work with.

Once you've set up your data pipeline to your HIPAA data source, you can relax – as long as nothing changes. You have to keep an eye on any modifications that your sources make to the data they deliver. You should also watch out for cases where your script doesn't recognize a new data type. And since you'll be responsible for maintaining your script, every time your users want slightly different information, you'll have to modify the script. Keep in mind that HIPAA is all about rules and compliance, so you'll also have to know what HIPAA permits and proscribes, as will anyone else who works on the script.