HIPAA Readiness

• HIPAA 164.308(a)(3)(i) - Workforce security
• HIPAA 164.310(d)(2)(i) - Disposal
• HIPPA 164.310(d)(2)(iv) - Data backup and storage
• HIPAA 164.308(a)(3)(ii)(C) - Termination procedures
• HIPAA 164.308(a)(3)(ii)(B) - Workforce clearance procedure

• 164.312(a)(1) - Access control
• 164.312(a)(2)(iv) - Encryption and decryption
• 164.312(e)(1) - Transmission security
• 164.312(e)(2)(i) - Integrity controls
• 164.312(e)(2)(ii) - Encryption

• Check if S3 buckets have server access logging enabled
• Enable S3 buckets have Object-level logging enabled in CloudTrail
• Ensure there are no EBS Snapshots set as Public
• Ensure there are no Security Groups not being used
• Ensure Elastic Load Balancers have logging enabled

• 164.312(a)(2)(ii) - Emergency access procedure
• 164.310(d)(2)(ii) Media re-use
• 164.310(c) - Workstation security
• 164.310(b) Workstation use
• 163.310(a)(2)(iv) - Maintenance records

• 164.308(a)(1)(ii)(C)- Sanction policy
• 164.308(a)(7)(ii)(C)- Emergency mode operation plan
• 164.308(a)(7)(ii)(E)- Applications and data criticality analysis

HIPAA controls in the Breach Notification Rule family.

• HIPAA 164.402(a) — Definitions: Breach - Risk Assessment
• HIPAA 164.402(b) — Definitions: Breach - exceptions (unsecured PHI)
• HIPAA 164.404(a) — Notice to Individuals

• Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
• Ensure VPC flow logging is enabled in all VPCs
• Ensure a log metric filter and alarm exist for S3 bucket policy changes

HIPAA controls in the Privacy Rule family.

• HIPAA 164.502(a)(5)(i) — Prohibited uses and disclosures - Use and disclosure of genetic information for underwriting purposes
• HIPAA 164.502(f) — Deceased individuals
• HIPAA 164.502(g) — Personal representatives

HIPAA controls in the Security Rule family.

• HIPAA 164.306(a) — General Requirements
• HIPAA 164.306(b) — Flexibility of approach
• HIPAA 164.308(a) — Security Management Process

• Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
• Ensure MFA is enabled for the "root" account

• 164.308(a)(7)(ii)(D) - Testing and revision procedures

• Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible

• Ensure CloudTrail logs are encrypted at rest using KMS CMKs

• HIPAA 164.312(e)(2)(ii) - Encryption

Plain-English overview of the framework.

• HIPAA Security & Privacy Rules — overview

• HIPAA 164.310(d)(2)(iii) - Accountability