HIPAA requirements, cloud enforcement via Cloud Custodian, and control coverage mapping.

HIPAA Compliance

HIPAA (Health Insurance Portability and Accountability Act) is a US federal law governing how Protected Health Information (PHI) is created, stored, processed, transmitted, and protected. It applies to healthcare providers, health plans, clearinghouses, and their Business Associates — including cloud providers, SaaS platforms, and MSPs handling PHI.

Core Requirements

A. Administrative Safeguards

Risk analysis and risk management.
Defined security policies and standard operating procedures.
Workforce training.
Incident response procedures.

B. Physical Safeguards

Data centre security (handled by the cloud provider).
Controlled access to systems.

C. Technical Safeguards

Access control (least privilege).
Audit controls (logging).
Integrity controls.
Transmission security (encryption).

HIPAA compliance is a combination of legal, technical, and operational controls. A signed Business Associate Agreement (BAA) with the cloud provider is mandatory when handling PHI.

Cloud Custodian HIPAA Coverage

Cloud Custodian enforces HIPAA Technical Safeguards by detecting and preventing cloud misconfigurations.

HIPAA Control Area	Covered	Description
Encryption at rest	✅ Cloud Custodian	S3, EBS, RDS encryption enforcement
Encryption in transit	✅ Cloud Custodian	HTTPS / TLS enforcement
Access control	✅ Cloud Custodian	MFA, IAM hygiene, least privilege
Audit controls	✅ Cloud Custodian	CloudTrail and logging checks
Exposure prevention	✅ Cloud Custodian	Public storage and network detection
Data retention	✅ Cloud Custodian	Resource lifecycle cleanup
Region control	✅ Cloud Custodian	Enforce approved regions

Sample Cloud Custodian Policies

Enforce S3 Encryption (PHI Storage)

policies:
  - name: hipaa-s3-encryption-required
    resource: s3
    filters:
      - type: bucket-encryption
        state: false

Block Public S3 Buckets

policies:
  - name: hipaa-no-public-s3
    resource: s3
    filters:
      - type: global-grants
        operator: not-equal
        value: []

Enforce MFA for IAM Users

policies:
  - name: hipaa-mfa-required
    resource: iam-user
    filters:
      - type: credential
        key: mfa_active
        value: false

Ensure CloudTrail is Enabled

policies:
  - name: hipaa-cloudtrail-enabled
    resource: account
    filters:
      - type: cloudtrail
        key: IsMultiRegionTrail
        value: true

Prevent Public RDS Instances

policies:
  - name: hipaa-no-public-rds
    resource: rds
    filters:
      - PubliclyAccessible: true

Full Controls Coverage

HIPAA Control / Requirement	Tool Coverage	Notes
Encryption at rest (S3/EBS/RDS)	Cloud Custodian	Cloud-side encryption configuration
Encryption in transit (TLS/HTTPS)	Cloud Custodian	HTTPS/TLS policies on ELB, S3, IAM
IAM least privilege	Cloud Custodian	IAM policy & role hygiene
MFA for users	Cloud Custodian	IAM credential checks
Public cloud resources	Cloud Custodian	S3, RDS, SG, snapshot exposure
Approved regions / data residency	Cloud Custodian	Region guardrails
Cloud audit logging (CloudTrail)	Cloud Custodian	Ensures audit trail exists
Log integrity (cloud)	❌	Requires secure storage + WORM process
OS & application logs	Wazuh	Host-based log collection
File integrity monitoring	Wazuh	Detects unauthorised file changes
Malware detection	Wazuh	Rootkits, trojans
Intrusion detection	Wazuh	Suspicious runtime behaviour
Vulnerability scanning	Wazuh	CVE detection on hosts
Incident evidence & forensics	Wazuh	Alerts, timelines, investigation data
Backup configuration	Cloud Custodian	Snapshot & backup configuration checks
Backup restore testing	❌	Requires periodic manual / DR testing
Business Associate Agreement (BAA)	❌	Legal contract, not tool-based
Risk assessment documentation	❌	Administrative safeguard
Workforce training	❌	Organisational process
Incident response plan	❌	Process & governance
Breach notification workflow	❌	Legal & operational

HIPAA Compliance

On this page