HIPAA Compliance
Implement HIPAA requirements for healthcare data protection.
HIPAA Rules
security_rule: administrative: - Risk analysis - Security management - Workforce training - Contingency planning
physical: - Facility access - Workstation security - Device controls
technical: - Access control - Audit controls - Integrity controls - Transmission security
Technical Safeguards
requirements: encryption: at_rest: AES-256 in_transit: TLS 1.2+
access_control: - Unique user IDs - Emergency access procedure - Automatic logoff - Encryption/decryption
audit: - Access logging - Activity monitoring - Log retention (6 years)
AWS HIPAA Setup
Enable CloudTrail for HIPAA auditing
aws cloudtrail create-trail
--name hipaa-audit-trail
--s3-bucket-name hipaa-logs
--is-multi-region-trail
--enable-log-file-validation
Use HIPAA-eligible services only
Best Practices
-
Business Associate Agreements (BAAs)
-
Minimum necessary access
-
Breach notification procedures
-
Regular risk assessments