1

Hello,

We have a VMware 8.03 environment with 5 win 10 pro VDI we want to upgrade to Win 11 pro but want to know is this is HIPAA compliant for desktop vdi deployment?

Does Hipaa have documentation stating which OS is compatible for Hipaa in vdi environment ?

Does it apply to regular windows desktop deployment?

Thanks in advance

3 Spice ups
2

HIPAA is about the security controls, not so much the OS.

https://www.hipaajournal.com/windows-11-hipaa-compliant/

For one example, encryption of data at rest, so if your SAN/Storage is not encrypted, the VM needs to be, you’ll need a KMS (not the same as Windows KMS) to do this. VMware VCSA does have a native key provider, you could use.

4 Spice ups
3

Thank you for the info and the article still does not clarify if we can use pro version or need to move to enterprise version for VDI environment

Also what KMS would you recommend using?

1 Spice up
4

That’s because as Rod mentioned - it’s not really an OS thing. Home/Pro/Enterprise can all be HIPAA compliant. It’s more around your implementation.

Windows 10 (all versions) is compliant today mostly because MS is still releasing updates, once they stop releasing updates - it’s no longer compliant. Windows 11 is compliant for the same reason(s).

Rod mentioned encryption at rest, while not a specific requirement (Pretty sure it’s addressable) it is advisable.

2 Spice ups
5

There is one built-in if you configure it.

It’s a little unclear of your goal, do you need desktop OSes, would RDS work?

1 Spice up
6

I just need to know if I create a windows 11 pro vdi I can use pro license or do I have to get Enterprise version?

If I use pro what I need to make sure its hipaa compliant

Thank you both

7

Negative. You need an EA agreement with SA rights or you need a VDA license.

Regardless of the OS, you need security controls in place - if the business is already HIPAA compliant for physicals, follow the same process.

8

Just to make sure we ae on the same page since this is giving me a brain fart…spinning up a windows 10 or 11 vm on a vmware esxi host is considered a VDI correct?

9

No. VDI is Virtual Desktop Infrastructure. It typically involves cloning VMs from a golden image in a product like VMWare Horizon or Citrix.

What you are doing is just spinning up a virtual machine on an ESXi host.

1 Spice up
10

@jasonfennell5736 Thanks for your answer

So spinning up window 11 pro will not be Hipaa compliant I need to go to Enterprise?

11

No, whether Pro or Enterprise HIPAA compliance is based on the configuration of the OS and other security controls, not the licensing level. If you set up the Win11 VMs correctly, i.e. the same security settings as you used on Win10, they will be compliant regardless if they are Pro or Enterprise.

1 Spice up
12

But from a licensing perspective this still requires EA with SA or VDA licenses if a user is accessing it remotely.

For clarity, here is a post by microsoft to hopefully make it simler.

Licensing Windows 10 with virtualization technologies - How-To - Windows - Spiceworks Community

1 Spice up