hipaa-compliance

name	hipaa-compliance
description	Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

HIPAA Compliance

Implement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).

When to Use

• Building or operating systems that handle electronic Protected Health Information
• Configuring cloud infrastructure for HIPAA-eligible workloads
• Establishing Business Associate Agreements with vendors
• Implementing technical safeguards for PHI protection
• Preparing for HIPAA compliance audits or OCR investigations

HIPAA Rules and Safeguards

security_rule:
  administrative_safeguards:
    164.308_a_1: "Security Management Process"
    actions:
      - Conduct risk analysis (required)
      - Implement risk management program (required)
      - Apply sanction policy for violations (required)
      - Review information system activity (required)

    164.308_a_3: "Workforce Security"
    actions:
      - Authorization/supervision procedures (addressable)
      - Workforce clearance procedure (addressable)
      - Termination procedures (addressable)

    164.308_a_4: "Information Access Management"
    actions:
      - Access authorization policies (addressable)
      - Access establishment and modification (addressable)
      - Isolate healthcare clearinghouse functions (required)

    164.308_a_5: "Security Awareness and Training"
    actions:
      - Security reminders (addressable)
      - Protection from malicious software (addressable)
      - Log-in monitoring (addressable)
      - Password management (addressable)

    164.308_a_6: "Security Incident Procedures"
    actions:
      - Response and reporting procedures (required)

    164.308_a_7: "Contingency Plan"
    actions:
      - Data backup plan (required)
      - Disaster recovery plan (required)
      - Emergency mode operation plan (required)
      - Testing and revision procedures (addressable)
      - Applications and data criticality analysis (addressable)

    164.308_a_8: "Evaluation"
    actions:
      - Periodic technical and nontechnical evaluation (required)

  physical_safeguards:
    164.310_a: "Facility Access Controls"
    164.310_b: "Workstation Use"
    164.310_c: "Workstation Security"
    164.310_d: "Device and Media Controls"

  technical_safeguards:
    164.312_a: "Access Control"
    actions:
      - Unique user identification (required)
      - Emergency access procedure (required)
      - Automatic logoff (addressable)
      - Encryption and decryption (addressable)

    164.312_b: "Audit Controls"
    actions:
      - Implement hardware/software/procedural mechanisms to record and examine access (required)

    164.312_c: "Integrity"
    actions:
      - Mechanism to authenticate ePHI (addressable)

    164.312_d: "Person or Entity Authentication"
    actions:
      - Verify identity of person/entity seeking access (required)

    164.312_e: "Transmission Security"
    actions:
      - Integrity controls (addressable)
      - Encryption (addressable)

privacy_rule:
  minimum_necessary: "Limit PHI use, disclosure, and requests to minimum necessary"
  individual_rights: "Access, amendment, accounting of disclosures, restrictions"
  notice_of_practices: "Provide notice of privacy practices to individuals"

breach_notification_rule:
  individual_notification: "Within 60 days of discovery"
  hhs_notification: "Annual for <500 records; within 60 days for 500+"
  media_notification: "Required when 500+ individuals in a state/jurisdiction"

Technical Safeguards Implementation Checklist

encryption_requirements:
  at_rest:
    standard: AES-256
    aws_services:
      - [ ] RDS encryption enabled (KMS managed key)
      - [ ] S3 bucket default encryption (SSE-KMS)
      - [ ] EBS volume encryption enabled
      - [ ] DynamoDB table encryption (KMS)
      - [ ] ElastiCache encryption at rest enabled
      - [ ] Redshift cluster encryption enabled
      - [ ] EFS encryption enabled
    azure_services:
      - [ ] Azure SQL TDE enabled (customer-managed key)
      - [ ] Storage Account encryption (CMK)
       [ ]      
       [ ]     
    
       [ ]    
       [ ]    
       [ ]   
       [ ]    

  
        
    
       [ ]       
       [ ]   
       [ ]    
       [ ]    
       [ ]      
       [ ]       
       [ ]       

  
     [ ]       
     [ ]     
     [ ]       
     [ ]        
     [ ]    


  
     [ ]      
     [ ]        
     [ ]        
     [ ]     

  
     [ ]       
     [ ]     
     [ ]       
     [ ]     

  
     [ ]        
     [ ]    
     [ ]   
     [ ]      

  
     [ ]     
     [ ]     
     [ ]       
     [ ]    


  
     [ ]       
     [ ]    
     [ ]   
     [ ]    
     [ ]        
     [ ]      
     [ ]     

  
     [ ]       
     [ ]       
     [ ]   
     [ ]   

AWS HIPAA-Eligible Architecture

# Verify you are using only HIPAA-eligible AWS services
# Reference: https://aws.amazon.com/compliance/hipaa-eligible-services-reference/

# Create a dedicated VPC for PHI workloads
aws ec2 create-vpc --cidr-block 10.100.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'

# Enable VPC flow logs for network auditing
aws ec2 create-flow-log \
  --resource-type VPC \
  --resource-ids vpc-XXXXXXXX \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /vpc/phi-flow-logs \
  --deliver-logs-permission-arn arn:aws:iam::123456789012:role/VPCFlowLogsRole

# Create encrypted RDS instance for PHI
aws rds create-db-instance \
  --db-instance-identifier phi-database \
  --db-instance-class db.r6g.large \
  --engine postgres \
  --master-username admin \
  --master-user-password "USE_SECRETS_MANAGER" \
  --storage-encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias/phi-rds-key \
  --vpc-security-group-ids sg-XXXXXXXX \
  --db-subnet-group-name phi-subnet-group \
  --backup-retention-period 35 \
  --multi-az \
  --deletion-protection \
  --enable-cloudwatch-logs-exports '["postgresql","upgrade"]' \
  --tags Key=Compliance,Value=HIPAA Key=DataClassification,Value=PHI

# Create S3 bucket with HIPAA controls
aws s3api create-bucket --bucket phi-data-bucket --region us-east-1

aws s3api put-bucket-encryption --bucket phi-data-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/phi-s3-key"}, "BucketKeyEnabled": true}]
  }'

aws s3api put-public-access-block --bucket phi-data-bucket \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

aws s3api put-bucket-versioning --bucket phi-data-bucket \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-logging --bucket phi-data-bucket \
  --bucket-logging-status '{"LoggingEnabled": {"TargetBucket": "phi-access-logs", "TargetPrefix": "phi-data-bucket/"}}'

# Enable CloudTrail data events for PHI buckets
aws cloudtrail put-event-selectors --trail-name hipaa-audit-trail \
  --advanced-event-selectors '[{
    "Name": "PHI-S3-DataEvents",
    "FieldSelectors": [
      {"Field": "eventCategory", "Equals": ["Data"]},
      {"Field": "resources.type", "Equals": ["AWS::S3::Object"]},
      {"Field": "resources.ARN", "StartsWith": ["arn:aws:s3:::phi-data-bucket/"]}
    ]
  }]'

Business Associate Agreement Tracking

baa_tracking:
  required_when:
    - Vendor creates, receives, maintains, or transmits PHI on your behalf
    - Subcontractor of a business associate handles PHI
    - Cloud service provider stores or processes PHI

  not_required_for:
    - Conduit exception (postal service, ISP carrying encrypted data)
    - Treatment providers sharing PHI for treatment purposes
    - Plan sponsor receiving summary health information

  baa_registry:
    format:
      vendor_name: 
       
       
       []
       
       []
       
       
       
       

  
    
               
              
             
    
              
            
    
                 
          

  
     [ ]      
     [ ]      
     [ ]      
     [ ]       
     [ ]     

Risk Analysis Automation

#!/usr/bin/env bash
# hipaa-risk-scan.sh - Technical risk analysis checks for HIPAA

echo "=== HIPAA Technical Safeguard Checks ==="

echo "--- Encryption at Rest ---"
# Check for unencrypted RDS instances
UNENCRYPTED_RDS=$(aws rds describe-db-instances \
  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' --output text)
[ -z "$UNENCRYPTED_RDS" ] && echo "PASS: All RDS instances encrypted" || \
  echo "FAIL: Unencrypted RDS: $UNENCRYPTED_RDS"

# Check for unencrypted S3 buckets
for bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do
  enc=$(aws s3api get-bucket-encryption --bucket "$bucket" 2>/dev/null)
  [ -z "$enc" ] && echo "FAIL: S3 bucket $bucket has no default encryption"
done

# Check for unencrypted EBS volumes
UNENCRYPTED_EBS=$(aws ec2 describe-volumes \
  --query 'Volumes[?Encrypted==`false`].VolumeId' --output text)
[ -z "$UNENCRYPTED_EBS" ] && echo "PASS: All EBS volumes encrypted" || \
  echo "FAIL: Unencrypted EBS: $UNENCRYPTED_EBS"

echo "--- Access Control ---"
# Check for users without MFA
aws iam generate-credential-report > /dev/null 2>&1 && sleep 5
aws iam get-credential-report --output text --query Content | base64 -d | \
  awk -F, 


THRESHOLD=$( -d  +%Y-%m-%dT%H:%M:%S 2>/dev/null ||  -v-90d +%Y-%m-%dT%H:%M:%S)
aws iam get-credential-report --output text --query Content |  -d | \
  awk -F, -v t= 

 

CT_STATUS=$(aws cloudtrail get-trail-status --name hipaa-audit-trail --query  --output text)
[  =  ] &&   ||  


 vpc  $(aws ec2 describe-vpcs --query  --output text); 
  fl=$(aws ec2 describe-flow-logs --filter  --query  --output text)
  [  =  ] &&  


 

 alb  $(aws elbv2 describe-load-balancers --query  --output text); 
  HTTPS=$(aws elbv2 describe-listeners --load-balancer-arn  \
    --query  --output text)
  [ -z  ] &&  


 

HIPAA Compliance Checklist

hipaa_compliance_checklist:
  administrative:
    - [ ] Risk analysis conducted and documented
    - [ ] Risk management plan implemented
    - [ ] Security officer designated
    - [ ] Privacy officer designated
    - [ ] Workforce security awareness training completed
    - [ ] Sanction policy documented and communicated
    - [ ] Contingency plan (backup, DR, emergency mode) documented
    - [ ] Business associate agreements signed for all applicable vendors
    - [ ] Periodic evaluation/audit scheduled

  technical:
    - [ ]    
     [ ]       
     [ ]     
     [ ]        
     [ ]         
     [ ]       
     [ ]      
     [ ]      
     [ ]     

  
     [ ]    
     [ ]     
     [ ]      
     [ ]    

  
     [ ]    
     [ ]     
     [ ]    
     [ ]    
     [ ]   
     [ ]    

  
     [ ]    
     [ ]    
     [ ]    
     [ ]    
     [ ]     
     [ ]     

Best Practices

• Conduct a thorough risk analysis annually and after significant system changes
• Use only HIPAA-eligible cloud services and sign BAAs before deploying PHI workloads
• Encrypt all PHI at rest and in transit with no exceptions
• Implement the minimum necessary standard: grant access only to the PHI needed for each role
• Maintain audit logs of all PHI access for a minimum of 6 years
• Train all workforce members on HIPAA policies at onboarding and annually
• Test contingency plans (backup restore, DR failover, emergency access) at least annually
• Track all Business Associate Agreements in a central registry with review dates
• Document every addressable specification decision (implement, alternative, or not applicable with rationale)
• Prepare breach notification templates and procedures before an incident occurs