hipaa-compliance – Security skill for AI agents

HIPAA Compliance

Implement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).

When to Use

• Building or operating systems that handle electronic Protected Health Information
• Configuring cloud infrastructure for HIPAA-eligible workloads
• Establishing Business Associate Agreements with vendors
• Implementing technical safeguards for PHI protection
• Preparing for HIPAA compliance audits or OCR investigations

This is a control-mapping aid, not a compliance determination. Establish covered-entity/business-associate applicability and have qualified privacy/security counsel verify current effective rules. Proposed rules are not effective requirements. AES-256, TLS versions, MFA, 15-minute sessions, CMKs and annual/quarterly schedules below are baseline design choices, not universal statutory prescriptions. Addressable does not mean optional without documented risk assessment. Never send PHI to an unapproved service.

HIPAA Rules and Safeguards

security_rule:
  administrative_safeguards:
    164.308_a_1: "Security Management Process"
    actions:
      - Conduct risk analysis (required)
      - Implement risk management program (required)
      - Apply sanction policy for violations (required)
      - Review information system activity (required)

    164.308_a_3: "Workforce Security"
    actions:
      - Authorization/supervision procedures (addressable)
      - Workforce clearance procedure (addressable)
      - Termination procedures (addressable)

    164.308_a_4: "Information Access Management"
    actions:
      - Access authorization policies (addressable)
      - Access establishment and modification (addressable)
      - Isolate healthcare clearinghouse functions (required)

    164.308_a_5: "Security Awareness and Training"
    actions:
      - Security reminders (addressable)
      - Protection from malicious software (addressable)
      - Log-in monitoring (addressable)
      - Password management (addressable)

    164.308_a_6: "Security Incident Procedures"
    actions:
      - Response and reporting procedures (required)

    164.308_a_7: "Contingency Plan"
    actions:
      - Data backup plan (required)
      - Disaster recovery plan (required)
      - Emergency mode operation plan (required)
      - Testing and revision procedures (addressable)
      - Applications and data criticality analysis (addressable)

    164.308_a_8: "Evaluation"
    actions:
      - Periodic technical and nontechnical evaluation (required)

  physical_safeguards:
    164.310_a: "Facility Access Controls"
    164.310_b: "Workstation Use"
    164.310_c: "Workstation Security"
    164.310_d: "Device and Media Controls"

  technical_safeguards:
    164.312_a: "Access Control"
    actions:
      - Unique user identification (required)
      - Emergency access procedure (required)
      - Automatic logoff (addressable)
      - Encryption and decryption (addressable)

    164.312_b: "Audit Controls"
    actions:
      - Implement hardware/software/procedural mechanisms to record and examine access (required)

    164.312_c: "Integrity"
    actions:
      - Mechanism to authenticate ePHI (addressable)

    164.312_d: "Person or Entity Authentication"
    actions:
      - Verify identity of person/entity seeking access (required)

    164.312_e: "Transmission Security"
    actions:
      - Integrity controls (addressable)
      - Encryption (addressable)

privacy_rule:
  minimum_necessary: "Limit PHI use, disclosure, and requests to minimum necessary"
  individual_rights: "Access, amendment, accounting of disclosures, restrictions"
  notice_of_practices: "Provide notice of privacy practices to individuals"

breach_notification_rule:
  individual_notification: "Without unreasonable delay, no later than 60 calendar days after discovery, subject to applicable exceptions"
  hhs_notification: "Fewer than 500 individuals: within 60 days after discovery year ends; 500+: without unreasonable delay and no later than 60 days"
  media_notification: "More than 500 residents of a state/jurisdiction; without unreasonable delay, within 60 days"

Technical Safeguards Implementation Checklist

encryption_requirements:
  at_rest:
    standard: AES-256
    aws_services:
      - [ ] RDS encryption enabled (KMS managed key)
      - [ ] S3 bucket default encryption (SSE-KMS)
      - [ ] EBS volume encryption enabled
      - [ ] DynamoDB table encryption (KMS)
      - [ ] ElastiCache encryption at rest enabled
      - [ ] Redshift cluster encryption enabled
      - [ ] EFS encryption enabled
    azure_services:
      - [ ] Azure SQL TDE enabled (customer-managed key)
      - [ ] Storage Account encryption (CMK)
      - [ ] Managed Disk encryption (SSE with CMK)
      - [ ] Cosmos DB encryption at rest
    gcp_services:
      - [ ] Cloud SQL encryption (CMEK)
      - [ ] Cloud Storage encryption (CMEK)
      - [ ] BigQuery encryption (CMEK)
      - [ ] Persistent Disk encryption (CMEK)

  in_transit:
    standard: TLS 1.2 or higher
    checks:
      - [ ] TLS 1.2+ enforced on all load balancers
      - [ ] HTTP-to-HTTPS redirect enabled
      - [ ] Internal service-to-service mTLS configured
      - [ ] Database connections use SSL/TLS
      - [ ] API gateways enforce TLS minimum version
      - [ ] Email encryption for PHI (S/MIME or TLS)
      - [ ] VPN or private connectivity for admin access

  key_management:
    - [ ] Customer-managed KMS keys for PHI data stores
    - [ ] Key rotation enabled (annual minimum)
    - [ ] Key access restricted to authorized roles only
    - [ ] Key usage audited via CloudTrail / audit logs
    - [ ] Key deletion protection enabled

access_control:
  unique_user_identification:
    - [ ] Individual user accounts (no shared credentials)
    - [ ] MFA enforced for all users accessing PHI systems
    - [ ] Service accounts with unique identities and audited usage
    - [ ] Federated identity with SSO (SAML/OIDC)

  role_based_access:
    - [ ] Least privilege roles defined per job function
    - [ ] PHI access restricted to need-to-know
    - [ ] Separate roles for data access vs. administration
    - [ ] Privileged access requires just-in-time approval

  session_management:
    - [ ] Automatic session timeout (15 minutes idle for workstations)
    - [ ] Re-authentication for sensitive operations
    - [ ] Concurrent session limits
    - [ ] Session tokens secured (HttpOnly, Secure, SameSite)

  emergency_access:
    - [ ] Break-glass procedure documented and tested
    - [ ] Emergency access credentials stored securely
    - [ ] All emergency access usage audited and reviewed
    - [ ] Emergency access automatically expires

audit_controls:
  logging_requirements:
    - [ ] All PHI access logged (read, write, delete)
    - [ ] User authentication events logged
    - [ ] Administrative actions logged
    - [ ] Failed access attempts logged
    - [ ] Log integrity protection (hash chaining or WORM storage)
    - [ ] Log retention set by applicable law, risk analysis and documented policy
    - [ ] Regular log review process documented

  monitoring:
    - [ ] Real-time alerting on unauthorized PHI access attempts
    - [ ] Anomaly detection for unusual data access patterns
    - [ ] Privileged action monitoring
    - [ ] Data export/download alerting

AWS HIPAA-Eligible Architecture

Provisioning examples incur cost and alter account state. Review account, region, names, eligible-service scope, BAA, KMS/network prerequisites and rollback before an authorized change. A HIPAA tag or encryption flag does not establish compliance. put-event-selectors replaces existing selectors: read and merge the full desired configuration before applying it.

# Verify you are using only HIPAA-eligible AWS services
# Reference: https://aws.amazon.com/compliance/hipaa-eligible-services-reference/

# Create a dedicated VPC for PHI workloads
aws ec2 create-vpc --cidr-block 10.100.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'

# Enable VPC flow logs for network auditing
aws ec2 create-flow-log \
  --resource-type VPC \
  --resource-ids vpc-XXXXXXXX \
  --traffic-type ALL \
  --log-destination-type cloud-watch-logs \
  --log-group-name /vpc/phi-flow-logs \
  --deliver-logs-permission-arn arn:aws:iam::123456789012:role/VPCFlowLogsRole

# Create encrypted RDS instance for PHI
aws rds create-db-instance \
  --db-instance-identifier phi-database \
  --db-instance-class db.r6g.large \
  --engine postgres \
  --master-username admin \
  --manage-master-user-password \
  --allocated-storage 100 \
  --storage-encrypted \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias/phi-rds-key \
  --vpc-security-group-ids sg-XXXXXXXX \
  --db-subnet-group-name phi-subnet-group \
  --backup-retention-period 35 \
  --multi-az \
  --d

… (full content is in the download package)