One of our clients is requesting that we provide a quotation for the development and hosting of an online Electronic Medical Records (EMR) system. By law, the system will need to be HIPPA compliant and also meet the legal criteria for protected health information (PHI).
My question is this:
Would a shared Linux server using htaccess for directory-level permissions* be adequate and appropriate? If not, should I recommend a VPS or will this require a dedicated server?
*Most data will be in the form of PDF files; access control via encrypted cookies, written after login via https with encypted passwords in a MYSQL DB, also in the shared environment.