HIPAA Omnibus Rule 2013
Best for: Any covered entity or business associate that creates, receives, maintains, or transmits electronic protected health information (ePHI). This includes hospitals, health plans, healthcare clearinghouses, and their subcontractors. If you run infrastructure on AWS for a healthcare client, you are likely a business associate and must comply. There is no revenue or size threshold.
| Mandatory? | Mandatory for covered entities and business associates |
| Who validates? | No formal certification; HHS/OCR enforcement |
| Renewal | No fixed cycle; periodic risk assessments required |
| Scope | Protected health information (PHI) across covered entities and BAs |
🏛 U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) · HIPAA Omnibus Rule 2013 Official source →
Get Started
module "..." {
source = "hipaa.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}What Compliance.tf Covers vs. What You Handle
What Compliance.tf automates
- Audit Logging and Monitoring: Runs 9 controls validating CloudTrail configuration across regions, S3 object-level event logging for both read and write operations, API Gateway stage logging, X-Ray tracing, and CloudFront access logs. These map directly to Section 164.312(b) audit control requirements.
- Encryption in Transit: Checks SSL certificate assignment on API Gateway stages, CloudFront HTTPS enforcement, and ACM certificate expiration within 30 days. Covers Section 164.312(e)(1) transmission security requirements for AWS-managed endpoints.
- Encryption at Rest: Validates encryption on API Gateway stage caches and AWS Backup recovery points. The full 50-control benchmark includes additional checks for S3, EBS, and RDS encryption not shown in the sample set.
- Backup and Contingency Planning: Enforces minimum 35-day retention on backup plans and recovery points, verifies encryption on recovery points, and confirms manual deletion is disabled. Maps to Section 164.308(a)(7) contingency plan requirements.
- Network Access Control: Confirms Auto Scaling launch configurations do not assign public IPs and that load-balanced Auto Scaling groups use health checks. Validates basic network isolation controls under Section 164.312(a)(1).
What you handle
- Audit Logging and Monitoring: Defining log retention periods, reviewing audit logs on a regular schedule, configuring alerts for suspicious access to ePHI, and documenting your log review procedures. You also need to ensure logs are protected from tampering per Section 164.312(c)(2).
- Encryption in Transit: Enforcing TLS minimum version policies (TLS 1.2 or higher), managing certificate rotation for non-ACM certificates, and encrypting ePHI transmissions that occur outside AWS (for example, SFTP to partners or email encryption).
- Encryption at Rest: KMS key access policies, key rotation schedules, documenting which encryption method applies to each data store, and managing encryption for on-premises or hybrid systems outside AWS.
- Backup and Contingency Planning: Testing restore procedures periodically, documenting your disaster recovery plan, maintaining an emergency mode operations plan, and confirming that your retention periods satisfy the 6-year HIPAA documentation requirement where applicable.
- Network Access Control: Implementing VPC segmentation for ePHI workloads, configuring security groups and NACLs, managing VPN or Direct Connect for administrative access, and documenting your network architecture in a data flow diagram.
Controls by Category
Audit Controls (Section 164.312(b)) (4 controls)
Section 164.312(b) requires hardware, software, and procedural mechanisms that record and examine activity in systems containing ePHI. Assessors will want CloudTrail enabled across all regions with object-level logging on S3 buckets that store ePHI. The most common gap: CloudTrail active at the account level but data-plane events missing for S3 read and write operations, which leaves material holes in the access audit trail.
Contingency Plan (Section 164.308(a)(7)) (1 control)
Do backup plans exist, are recovery points retained long enough, and can they be deleted before their retention period expires? Those three questions drive most 164.308(a)(7) findings. Retention policies must align to HIPAA's 6-year documentation requirement under 45 CFR 164.530(j), and manually deletable recovery points come up repeatedly in organizations that haven't thought through insider threat or ransomware scenarios.
Encryption at Rest (Section 164.312(a)(2)(iv)) (1 control)
The first thing an assessor examines is whether encryption is enabled by default, not applied retroactively after a finding. ePHI in caches, backups, databases, and object stores all need AES-256 or equivalent, and KMS key policies get scrutinized. Unencrypted backup recovery points are a persistent gap: organizations encrypt primary storage and miss the backup vault entirely.
Transmission Security (Section 164.312(e)(1)) (2 controls)
Every endpoint transmitting ePHI needs TLS enforcement, and assessors will check certificate validity, expiration dates, and whether plaintext HTTP is blocked or redirected. Expired ACM certificates are a frequent finding because automated renewal sometimes fails for imported or DNS-validated certificates that have lost their validation records.
Additional Controls (96)
AWS CloudTrail (3)
AWS CodeBuild (1)
AWS Database Migration Service (1)
AWS IAM (8)
AWS Lambda (4)
AWS Secrets Manager (1)
Amazon CloudWatch (2)
Amazon CloudWatch Logs (1)
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
Amazon EBS (2)
Amazon EC2 (6)
compliance.tf moduleEC2 instances should have EBS optimization enabledcompliance.tf moduleEC2 instances should have IAM profile attachedcompliance.tf moduleEC2 instances should be in a VPCcompliance.tf moduleEC2 instances should not have a public IP addresscompliance.tf moduleEC2 instances should use IMDSv2compliance.tf moduleAmazon EFS (2)
Amazon EKS (1)
Amazon ElastiCache (1)
Amazon OpenSearch Service (4)
Amazon RDS (14)
compliance.tf moduleRDS DB instance backup should be enabledcompliance.tf moduleRDS DB instances backup retention period should be greater than or equal to 7compliance.tf moduleRDS DB instances should be integrated with CloudWatch logscompliance.tf moduleRDS DB instances should have deletion protection enabledcompliance.tf moduleRDS DB instance encryption at rest should be enabledcompliance.tf moduleRDS DB instances should have iam authentication enabledcompliance.tf moduleRDS DB instances should have logging enabledcompliance.tf moduleRDS for MariaDB DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should have multiple AZ enabledcompliance.tf moduleRDS DB instances should not use public subnetcompliance.tf moduleRDS for PostgreSQL DB instances should publish logs to CloudWatch Logscompliance.tf moduleRDS DB instances should prohibit public accesscompliance.tf moduleRDS for SQL Server DB instances should publish logs to CloudWatch Logscompliance.tf moduleAmazon Redshift (8)
compliance.tf moduleRedshift clusters should have automatic snapshots enabledcompliance.tf moduleRedshift cluster encryption in transit should be enabledcompliance.tf moduleRedshift clusters should have audit logging and encryption enabledcompliance.tf moduleRedshift clusters should have enhanced VPC routing enabledcompliance.tf moduleRedshift clusters should have KMS encryption enabledcompliance.tf moduleRedshift clusters should have required maintenance settingscompliance.tf moduleRedshift clusters should prohibit public accesscompliance.tf moduleAmazon S3 (13)
compliance.tf moduleS3 buckets should have default encryption enabledcompliance.tf moduleS3 buckets should have default encryption enabled using KMScompliance.tf moduleS3 buckets should have logging enabledcompliance.tf moduleS3 buckets should not be accessible to all authenticated userscompliance.tf moduleS3 buckets should have object lock enabledcompliance.tf moduleS3 buckets should have object logging enabledS3 buckets should have policies that prohibit public accesscompliance.tf moduleS3 buckets should prohibit public read accesscompliance.tf moduleS3 buckets should prohibit public write accesscompliance.tf moduleS3 buckets should have versioning enabledcompliance.tf moduleS3 public access should be blocked at account levelcompliance.tf moduleS3 public access should be blocked at bucket levelcompliance.tf moduleAmazon SageMaker (4)
Elastic Load Balancing (7)
compliance.tf moduleELB application load balancer deletion protection should be enabledcompliance.tf moduleELB application load balancers should be configured to drop HTTP headerscompliance.tf moduleELB application load balancers should drop invalid HTTP headerscompliance.tf moduleELB application and network load balancers should only use SSL or HTTPS listenerscompliance.tf moduleELB application and network load balancer listeners should use secure protocolscompliance.tf moduleELB classic load balancers should have cross-zone load balancing enabledcompliance.tf moduleRelated Frameworks
HIPAA Security Rule 2003 — 🟢 High overlap (85%)
The 2013 Omnibus Rule builds directly on the original HIPAA Security Rule (45 CFR Part 164, Subparts A and C). Most technical safeguard controls are identical. The Omnibus Rule adds breach notification requirements, extends obligations to business associates, and changes the breach risk assessment standard from 'significant risk of harm' to the broader 'low probability of compromise' test.
NIST 800-53 Rev 5 — 🟡 Medium overlap (55%)
HHS published a crosswalk mapping HIPAA Security Rule standards to NIST 800-53 controls. Organizations already compliant with NIST 800-53 families AU (Audit), AC (Access Control), SC (System and Communications Protection), and CP (Contingency Planning) will satisfy many HIPAA technical safeguards. NIST is broader in scope and includes controls for areas HIPAA does not explicitly address, such as supply chain risk management.
NIST CSF v1.0 — 🟡 Medium overlap (45%)
OCR has published guidance mapping the NIST Cybersecurity Framework to HIPAA. The CSF Protect and Detect functions align well with HIPAA technical safeguards, but CSF is voluntary and higher-level. Using CSF as your risk management structure can simplify HIPAA compliance reporting.