HIPAA: Health Information Protection

AWS 42 automated checks

Technical, administrative, and physical safeguards aligned with the HIPAA Security Rule (45 CFR Part 164) for protecting electronic protected health information (ePHI) in AWS environments

Administrative Safeguards

Organization should designate a HIPAA Security Officer 164.308(a)(2) · Critical
Organization should conduct HIPAA-compliant risk analysis 164.308(a)(1)(ii)(A) · Critical
Organization should maintain a sanctions policy for violations 164.308(a)(1)(ii)(C) · High
Organization should regularly review information system activity 164.308(a)(1)(ii)(D) · High

Administrative Safeguards: Awareness & Training (164.308(a)(5))

IAM password policy must require minimum length of 14 164.308(a)(5) · Medium

Administrative Safeguards: Contingency Plan (164.308(a)(7))

RDS cluster backup retention should be at least 14 days 164.308(a)(7) · Medium
DynamoDB table must have point-in-time recovery enabled 164.308(a)(7) · High
RDS instance must have Multi-AZ enabled 164.308(a)(7) · High

Administrative Safeguards: Incident Procedures (164.308(a)(6))

IAM password policy must require minimum length of 14 164.308(a)(6) · Medium

Administrative Safeguards: Information Access Management (164.308(a)(4))

IAM root user must not have access keys 164.308(a)(4) · Critical
IAM group should be used for permission management 164.308(a)(4) · Low
IAM policy must be attached and in use 164.308(a)(4) · Low

Administrative Safeguards: Security Management (164.308(a)(1))

IAM password policy must require minimum length of 14 164.308(a)(1) · Medium

Administrative Safeguards: Workforce Security (164.308(a)(3))

IAM password policy must require minimum length of 14 164.308(a)(3) · Medium

Breach Notification

Organization should have breach notification procedures 164.404 · Critical

Business Associate Contracts

Organization should maintain Business Associate Agreements 164.308(b)(1) · Critical

Contingency Plan

Organization should maintain a contingency plan for ePHI 164.308(a)(7)(i) · High
Organization should test contingency plans periodically 164.308(a)(7)(ii)(D) · High

Physical Safeguards

Organization should implement facility access controls 164.310(a)(1) · High
Organization should implement workstation security policies 164.310(b) · Medium
Organization should implement device and media controls 164.310(d)(1) · High

Physical Safeguards: Facility Access (164.310(a)(1))

IAM password policy must require minimum length of 14 164.310(a)(1) · Medium

Physical Safeguards: Workstation Security (164.310(b))

IAM password policy must require minimum length of 14 164.310(b) · Medium

Security Awareness

Organization should provide HIPAA security awareness training 164.308(a)(5) · High

Security Incident Procedures

Organization should implement security incident response procedures 164.308(a)(6) · Critical

Technical Safeguards: Access Control (164.312(a)(1))

IAM user must have MFA enabled 164.312(a)(1) · Critical
Cognito user pool must enforce MFA 164.312(a)(1) · Critical
RDS instance must have IAM database authentication enabled 164.312(a)(1) · Medium
EKS cluster must disable public API endpoint access 164.312(a)(1) · High

Technical Safeguards: Audit Controls (164.312(b))

CloudTrail trail must be multi-region 164.312(b) · Critical
CloudTrail trail must have log file validation enabled 164.312(b) · High
AWS Config must record all supported resource types 164.312(b) · High
VPC must have flow logs enabled 164.312(b) · High

Technical Safeguards: Encryption (164.312(e)(2))

RDS cluster must have storage encryption enabled 164.312(e)(2) · High

Technical Safeguards: Integrity (164.312(c)(1))

S3 bucket must have versioning enabled 164.312(c)(1) · High
S3 bucket encryption should use SSE-KMS with a customer-managed key 164.312(c)(1) · Medium

Technical Safeguards: Transmission Security (164.312(e)(1))

Load balancer listener must use a secure SSL policy 164.312(e)(1) · High
CloudFront distribution must use TLS 1.2 minimum 164.312(e)(1) · High
Elasticsearch domain must enforce HTTPS 164.312(e)(1) · High
ElastiCache replication group must have in-transit encryption enabled 164.312(e)(1) · High

Workforce Security

Organization should implement workforce clearance procedures 164.308(a)(3)(ii)(B) · High
Organization should implement workforce termination procedures 164.308(a)(3)(ii)(C) · High

Measure your HIPAA: Health Information Protection posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation