hipaa-compliance

1# HIPAA Compliance
2 
3Implement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).
4 
5## When to Use
6 
7- Building or operating systems that handle electronic Protected Health Information
8- Configuring cloud infrastructure for HIPAA-eligible workloads
9- Establishing Business Associate Agreements with vendors
10- Implementing technical safeguards for PHI protection
11- Preparing for HIPAA compliance audits or OCR investigations
12 
13## HIPAA Rules and Safeguards
14 
15```yaml
16security_rule:
17  administrative_safeguards:
18    164.308_a_1: "Security Management Process"
19    actions:
20      - Conduct risk analysis (required)
21      - Implement risk management program (required)
22      - Apply sanction policy for violations (required)
23      - Review information system activity (required)
24 
25    164.308_a_3: "Workforce Security"
26    actions:
27      - Authorization/supervision procedures (addressable)
28      - Workforce clearance procedure (addressable)
29      - Termination procedures (addressable)
30 
31    164.308_a_4: "Information Access Management"
32    actions:
33      - Access authorization policies (addressable)
34      - Access establishment and modification (addressable)
35      - Isolate healthcare clearinghouse functions (required)
36 
37    164.308_a_5: "Security Awareness and Training"
38    actions:
39      - Security reminders (addressable)
40…