Looking for overview on subbmitting secure data on the web

This is one of those 'can't see the forest for the trees' questions. There's a lot of stuff out there but it's like drinking from a fire hose. Can you give me a concise outline of how we move forward on this?

We are a community mental health center. Everything we do needs to be HIPAA compliant.


We have a web site: www.ucsvt.org - it is informational and I suppose normally secure (it's hosted and our IT staff does not deal with it much). In my limited understanding, upgrading the security and capability of it is beyond our resources (and perhaps those of our current web host). I'm thinking that we need to keep what we have and link to sites that can provided security and a presence configured for us.

Here's what we want to do:

- accept survey information containing data covered by HIPAA

- accept job applications electronically, with normal business security. (We currently list jobs but ask applicants to download and print an application, and then (snail) mail or deliver it to us.)

What is a good overall way to treat this (beyond, "Hey, just google 'handle secure forms'", and do you have any specific recommendations of places which can help?

Thanks

Larry