MySQL Server Setup

Purpose

This document describes the MySQL database server configuration for the healthcare environment. MySQL is being evaluated as a replacement for the existing Advantage database software, which was flagged during SOC2 audit as end-of-life and no longer receiving security updates. A test server has been built in the dev environment with HIPAA-compliant configurations validated before any production migration occurs.

Current Status

Attribute	Value
Environment	Dev / Test only
Platform	Azure VM — Windows Server 2022
MySQL Version	TBD
Purpose	Replacing Advantage Database Server
Production Target	TBD — pending migration decision

The MySQL server is currently in the dev environment. No patient data or production ePHI is stored on this server. Production migration will be planned separately once testing is complete and leadership approves the migration timeline.

Background — Why MySQL

The existing Advantage Database Server was flagged during the SOC2 audit as insufficient due to the software no longer receiving security updates. End-of-life database software presents a HIPAA risk under the technical safeguards requirements, as unpatched software cannot adequately protect ePHI.

MySQL was selected as the replacement because:

• Actively maintained with regular security updates
• Strong HIPAA compliance track record
• Free and open source — no licensing cost
• Wide community support and documentation
• Compatible with Windows Server 2022

Server Configuration

Platform

The MySQL server runs on Windows Server 2022 in Azure. It is deployed as a VM within the appropriate subnet and security zone, consistent with the network topology described in the Azure infrastructure documentation.

HIPAA-Required Configurations

The following configurations are implemented on the test server and will be required on any production deployment:

Audit Logging

MySQL audit logging is enabled to record connection events, authentication attempts, and query activity against ePHI tables. This satisfies the HIPAA audit controls requirement (§164.312(b)).

# my.ini audit configuration
plugin-load-add=audit_log.dll
audit_log_file=C:/ProgramData/MySQL/MySQL Server 8.0/Data/audit.log
audit_log_format=JSON
audit_log_policy=ALL

Key events logged:

• All connection attempts (successful and failed)
• Authentication failures
• Query activity on sensitive tables
• User privilege changes

Encryption at Rest

Azure Disk Encryption is enabled on the VM managed disk hosting MySQL data files. This provides encryption at the storage layer independent of MySQL's built-in encryption, satisfying HIPAA §164.312(a)(2)(iii).

InnoDB tablespace encryption is also configured for an additional layer of protection at the database layer:

# my.ini encryption configuration
innodb_encrypt_tables=ON
innodb_encrypt_log=ON

TLS Enforcement

TLS is enforced for all client connections to MySQL. No unencrypted connections are permitted, satisfying HIPAA §164.312(e)(2)(ii).

# my.ini TLS configuration
require_secure_transport=ON
tls_version=TLSv1.2,TLSv1.3
ssl_ca=C:/certs/ca.pem
ssl_cert=C:/certs/server-cert.pem
ssl_key=C:/certs/server-key.pem

Backups

Backups are configured for the test server to validate the backup and restore process before production deployment. Backup validation — confirming a restore actually works — is a HIPAA requirement under the contingency plan safeguard (§164.308(a)(7)).

Backup approach:

• Veeam backup of the VM to S3 nightly (consistent with DR backup strategy)
• MySQL dump for logical backups of individual databases
• Restore testing to be completed before production deployment

Access Controls

Principle of least privilege is applied from initial setup:

• Application service accounts have only the permissions required for their function — no DBA-level access for application users
• DBA access restricted to named administrators only
• No anonymous or wildcard user accounts
• Root account login restricted to localhost only

-- Example: Revoke unnecessary privileges from application user
REVOKE ALL PRIVILEGES ON *.* FROM 'app_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE ON app_database.* TO 'app_user'@'%';

Network Placement

The MySQL server is placed in the database subnet within the appropriate security zone. Network security group rules restrict MySQL port (3306) access to application servers only — no direct access from workstations or the internet.

Migration Path from Advantage

The migration from Advantage to MySQL will follow this general sequence:

Phase	Activity	Status
1	Build and configure MySQL test server	✅ Complete
2	Validate HIPAA configurations in dev	✅ Complete
3	Application compatibility testing	🔄 In Progress
4	Data migration planning	📅 Pending
5	Production deployment	📅 Pending leadership approval
6	Advantage decommission	📅 After production validation

Advantage will remain in production until MySQL is fully validated and the migration is approved. The two systems will not run simultaneously with live data — a cutover approach will be used.

Pre-Production Checklist

Before promoting MySQL to production the following must be confirmed:

• [ ] Audit logging verified capturing expected events
• [ ] Encryption at rest confirmed on production VM disk
• [ ] TLS enforced — no unencrypted connections accepted
• [ ] Backup and restore tested successfully
• [ ] Application connectivity tested against MySQL
• [ ] Access controls reviewed — no overprivileged accounts
• [ ] Network security group rules restrict port 3306 appropriately
• [ ] Checkov scan of Terraform VM config passing
• [ ] Leadership sign-off on migration plan

Compliance Relevance

Requirement	Control	Implementation
HIPAA §164.312(a)(2)(iii) — Encryption at rest	ePHI encrypted at rest	Azure Disk Encryption + InnoDB encryption
HIPAA §164.312(b) — Audit controls	Activity logging	MySQL audit log plugin
HIPAA §164.312(d) — Authentication	Verify user identity	TLS client authentication, no anonymous accounts
HIPAA §164.312(e)(2)(ii) — Encryption in transit	ePHI encrypted in transit	TLS enforced via require_secure_transport
HIPAA §164.308(a)(7) — Contingency plan	Backup and restore	Veeam nightly backup, restore tested

Document History

Date	Change	Author
March 2026	Fixed Azure Network Topology link	Rory
February 2026	Initial draft — test server configuration	Rory

Related Documentation

• Azure Infrastructure Overview
• Azure Network Topology
• HIPAA Controls Matrix
• AWS DR Overview