HIPAA compliance framework

hipaa_aws

HIPAA

OfficialVerified

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is legislation that helps US workers to retain health insurance coverage when they change or lose jobs. The legislation also seeks to encourage electronic health records to improve the efficiency and quality of the US healthcare system through improved information sharing.

32requirements95checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance hipaa_aws

Requirements (32)

164.308 Administrative Safeguards21192

164_308_a_1_ii_aConduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.2

Attributes

Item Id: 164_308_a_1_ii_a
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_1_ii_bImplement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 164.306(a): Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.38

Attributes

Item Id: 164_308_a_1_ii_b
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_1_ii_dImplement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.16

Attributes

Item Id: 164_308_a_1_ii_d
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_3_iImplement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.15

Attributes

Item Id: 164_308_a_3_i
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_3_ii_aImplement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.14

Attributes

Item Id: 164_308_a_3_ii_a
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_3_ii_bImplement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.6

Attributes

Item Id: 164_308_a_3_ii_b
Section: 164.308 Administrative Safeguards
Service: iam

164_308_a_3_ii_cImplement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(b).1

Attributes

Item Id: 164_308_a_3_ii_c
Section: 164.308 Administrative Safeguards
Service: iam

164_308_a_4_iImplement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.3

Attributes

Item Id: 164_308_a_4_i
Section: 164.308 Administrative Safeguards
Service: iam

164_308_a_4_ii_aIf a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.21

Attributes

Item Id: 164_308_a_4_ii_a
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_4_ii_bImplement policies and procedures for granting access to electronic protected health information, As one illustrative example, through access to a workstation, transaction, program, process, or other mechanism.5

Attributes

Item Id: 164_308_a_4_ii_b
Section: 164.308 Administrative Safeguards
Service: iam

164_308_a_4_ii_cImplement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.9

Attributes

Item Id: 164_308_a_4_ii_c
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_5_ii_bProcedures for guarding against, detecting, and reporting malicious software.2

Attributes

Item Id: 164_308_a_5_ii_b
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_5_ii_cProcedures for monitoring log-in attempts and reporting discrepancies.3

Attributes

Item Id: 164_308_a_5_ii_c
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_5_ii_dProcedures for creating, changing, and safeguarding passwords.9

Attributes

Item Id: 164_308_a_5_ii_d
Section: 164.308 Administrative Safeguards
Service: iam

164_308_a_6_iImplement policies and procedures to address security incidents.8

Attributes

Item Id: 164_308_a_6_i
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_6_iiIdentify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.14

Attributes

Item Id: 164_308_a_6_ii
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_7_iEstablish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.6

Attributes

Item Id: 164_308_a_7_i
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_7_ii_aEstablish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.6

Attributes

Item Id: 164_308_a_7_ii_a
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_7_ii_bEstablish (and implement as needed) procedures to restore any loss of data.6

Attributes

Item Id: 164_308_a_7_ii_b
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_7_ii_cEstablish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.6

Attributes

Item Id: 164_308_a_7_ii_c
Section: 164.308 Administrative Safeguards
Service: aws

164_308_a_8Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which an entity's security policies and procedures meet the requirements of this subpart.2

Attributes

Item Id: 164_308_a_8
Section: 164.308 Administrative Safeguards
Service: aws

164.312 Technical Safeguards11115

164_312_a_1Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in 164.308(a)(4).18

Attributes

Item Id: 164_312_a_1
Section: 164.312 Technical Safeguards
Service: aws

164_312_a_2_iAssign a unique name and/or number for identifying and tracking user identity.4

Attributes

Item Id: 164_312_a_2_i
Section: 164.312 Technical Safeguards
Service: aws

164_312_a_2_iiEstablish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.5

Attributes

Item Id: 164_312_a_2_ii
Section: 164.312 Technical Safeguards
Service: aws

164_312_a_2_ivImplement a mechanism to encrypt and decrypt electronic protected health information.17

Attributes

Item Id: 164_312_a_2_iv
Section: 164.312 Technical Safeguards
Service: aws

164_312_bImplement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.17

Attributes

Item Id: 164_312_b
Section: 164.312 Technical Safeguards
Service: aws

164_312_c_1Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.7

Attributes

Item Id: 164_312_c_1
Section: 164.312 Technical Safeguards
Service: aws

164_312_c_2Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.8

Attributes

Item Id: 164_312_c_2
Section: 164.312 Technical Safeguards
Service: aws

164_312_dImplement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.4

Attributes

Item Id: 164_312_d
Section: 164.312 Technical Safeguards
Service: iam

164_312_e_1Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.10

Attributes

Item Id: 164_312_e_1
Section: 164.312 Technical Safeguards
Service: aws

164_312_e_2_iImplement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.9

Attributes

Item Id: 164_312_e_2_i
Section: 164.312 Technical Safeguards
Service: aws

164_312_e_2_iiImplement a mechanism to encrypt electronic protected health information whenever deemed appropriate.16

Attributes

Item Id: 164_312_e_2_ii
Section: 164.312 Technical Safeguards
Service: aws