HIPAA: Health Information Protection

Azure 41 automated checks

Technical, administrative, and physical safeguards aligned with the HIPAA Security Rule (45 CFR Part 164) for protecting electronic protected health information (ePHI) in cloud environments

Administrative Safeguards

Organization should have a documented incident response plan 164.308(a)(6) · High
Organization should conduct security awareness training 164.308(a)(5) · Medium
Organization should perform periodic access reviews 164.308(a)(4) · High
Organization should conduct periodic risk assessments 164.308(a)(1) · High
Organization should have a business continuity and disaster recovery plan 164.308(a)(7) · High
Organization should designate a HIPAA Security Officer 164.308(a)(2) · Critical
Organization should conduct HIPAA-compliant risk analysis 164.308(a)(1)(ii)(A) · Critical
Organization should maintain a sanctions policy for violations 164.308(a)(1)(ii)(C) · High
Organization should regularly review information system activity 164.308(a)(1)(ii)(D) · High

Administrative Safeguards: Awareness & Training (164.308(a)(5))

IAM password policy must require minimum length of 14 164.308(a)(5) · Medium

Administrative Safeguards: Contingency Plan (164.308(a)(7))

Key Vault must have soft delete and purge protection for contingency planning 164.308(a)(7) · High
IAM password policy must require minimum length of 14 164.308(a)(7) · Medium

Administrative Safeguards: Incident Procedures (164.308(a)(6))

IAM password policy must require minimum length of 14 164.308(a)(6) · Medium

Administrative Safeguards: Information Access Management (164.308(a)(4))

SQL Server should use Azure AD-only authentication 164.308(a)(4) · High

Administrative Safeguards: Security Management (164.308(a)(1))

IAM password policy must require minimum length of 14 164.308(a)(1) · Medium

Administrative Safeguards: Workforce Security (164.308(a)(3))

IAM password policy must require minimum length of 14 164.308(a)(3) · Medium

Breach Notification

Organization should have breach notification procedures 164.404 · Critical

Business Associate Contracts

Organization should maintain Business Associate Agreements 164.308(b)(1) · Critical

Contingency Plan

Organization should maintain a contingency plan for ePHI 164.308(a)(7)(i) · High
Organization should test contingency plans periodically 164.308(a)(7)(ii)(D) · High

Physical Safeguards

Organization should implement physical security controls 164.310(a) · Medium
Organization should implement facility access controls 164.310(a)(1) · High
Organization should implement workstation security policies 164.310(b) · Medium
Organization should implement device and media controls 164.310(d)(1) · High

Physical Safeguards: Facility Access (164.310(a)(1))

IAM password policy must require minimum length of 14 164.310(a)(1) · Medium

Physical Safeguards: Workstation Security (164.310(b))

IAM password policy must require minimum length of 14 164.310(b) · Medium

Security Awareness

Organization should provide HIPAA security awareness training 164.308(a)(5) · High

Security Incident Procedures

Organization should implement security incident response procedures 164.308(a)(6) · Critical

Technical Safeguards: Access Control (164.312(a)(1))

Key Vault should use RBAC authorization 164.312(a)(1) · Medium
Cosmos DB should disable local authentication 164.312(a)(1) · High
App Service must use managed identity for automatic logoff and credential management 164.312(a)(1) · High
Container Registry must disable admin user 164.312(a)(1) · High

Technical Safeguards: Audit Controls (164.312(b))

Key Vault diagnostic logs should be sent to Log Analytics 164.312(b) · Medium

Technical Safeguards: Integrity (164.312(c)(1))

Storage account blob encryption must be enabled 164.312(c)(1) · Critical

Technical Safeguards: Transmission Security (164.312(e)(1))

Storage account must enforce HTTPS transfer 164.312(e)(1) · High
SQL Server must use TLS 1.2 minimum 164.312(e)(1) · High
App Service must enforce HTTPS only 164.312(e)(1) · High
Redis Cache must disable non-SSL port 164.312(e)(1) · High
Cosmos DB should disable public network access 164.312(e)(1) · High

Workforce Security

Organization should implement workforce clearance procedures 164.308(a)(3)(ii)(B) · High
Organization should implement workforce termination procedures 164.308(a)(3)(ii)(C) · High

Measure your HIPAA: Health Information Protection posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation