Azure Compliance FrameworksRetired Frameworks
HIPAA Security Rule 2003
Deprecated Framework
This framework has been superseded by HIPAA Omnibus Final Rule 2013. Organizations should migrate to the 2013 rule, which strengthened privacy and security protections and expanded compliance obligations to business associates.
Best for: A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.
| Mandatory? | Mandatory for covered entities and business associates |
| Who validates? | No formal certification; HHS/OCR enforcement |
| Renewal | No fixed cycle; periodic risk assessments required |
| Scope | Electronic protected health information (ePHI) |
Controls by Category
164.308(a)(1)(ii)(A) Risk analysis (6 controls)
Microsoft Defender for Cloud policy assignments should have enforcement mode set to DefaultAzure subscriptions should have Microsoft Defender for Containers enabledAzure subscriptions should have Microsoft Defender for Azure Cosmos DB enabledAzure subscriptions should have Azure Defender for DNS enabledAzure subscriptions should have Microsoft Defender for Servers enabledUnprotected SQL Server virtual machines should have Azure Defender for SQL enabled
164.308(a)(1)(ii)(B) Risk Management (30 controls)
Azure subscriptions should have a custom role for administering resource locksNetwork security groups should prohibit inbound HTTP (port 80) access from the internetUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsKey vault keys should have automatic rotation enabledKey vaults should have Role-Based Access Control (RBAC) enabledAzure Key Vaults should use private linkKubernetes cluster nodes should prohibit public accessKubernetes clusters should have public access restrictions configuredStorage accounts containing operational log containers should use customer-managed keys for encryptionNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedNetwork security groups should have UDP services restricted from the internetSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)SQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabledStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private link
164.308(a)(1)(ii)(D) Information system activity review (13 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentAzure subscriptions should have Network Watcher enabledFlow log resources should have flow logging enabledSQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
164.308(a)(3)(i) Workforce security (8 controls)
App Service function apps should have public access restrictions configuredNetwork security groups should prohibit inbound HTTP (port 80) access from the internetAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)
164.308(a)(3)(ii)(A) Authorization and/or supervision (4 controls)
164.308(a)(3)(ii)(B) Workforce clearance procedure (5 controls)
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' role
164.308(a)(4)(i) Information access management (8 controls)
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'Microsoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleKey vaults should have Role-Based Access Control (RBAC) enabled
164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions (10 controls)
Virtual machines should be protected by Azure BackupCosmos DB accounts should use private linkDatabricks workspaces should have a customer-managed key configuredDatabricks workspaces should be in a customer-managed virtual networkKey vaults should have resource logs enabledAzure Key Vaults should use private linkStorage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private link
164.308(a)(4)(ii)(B) Access authorization (10 controls)
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should have a custom role for administering resource locksCosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)Azure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleKey vaults should have Role-Based Access Control (RBAC) enabledKubernetes clusters should use Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
164.308(a)(4)(ii)(C) Access establishment and modification (6 controls)
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5Azure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleMicrosoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'
164.308(a)(5)(ii)(B) Protection from malicious software (6 controls)
Virtual machines should have endpoint protection installedRunning container images should have no unresolved vulnerabilitiesVirtual machines should have system updates installedAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have Microsoft Defender for Cloud container image scanning enabledSecurity Center should have Windows Defender ATP (WDATP) integration selected
164.308(a)(5)(ii)(C) Log-in monitoring (4 controls)
164.308(a)(5)(ii)(D) Password management (4 controls)
Non-privileged Microsoft Entra ID users should have multifactor authentication enabledPrivileged Microsoft Entra ID users should have multifactor authentication enabledRBAC key vaults should have 'Expiration Date' configured for all secretsStorage accounts should each have 'Enable key rotation reminders' enabled
164.308(a)(6)(i) Security incident procedures (8 controls)
Security contacts should have attack path email notifications enabled at the configured minimum risk levelAzure subscriptions should have an Activity Log alert for Service Health incidentsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Create or Update Security SolutionAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabled
164.308(a)(6)(ii) Response and reporting (11 controls)
App Service apps should have 'HTTP logs' enabledKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupFlow log resources should have flow logging enabledMicrosoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact emailAzure subscriptions should have Microsoft Defender for Servers enabledAzure subscriptions should have email notifications for high severity alerts enabledAzure subscriptions should have email notifications to subscription owners for high severity alerts enabledSQL servers should have auditing enabled
164.308(a)(7)(i) Contingency plan (8 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreKey vaults should have deletion protection enabledKey vaults should have soft delete enabledStorage accounts should have blob versioning enabledAzure Blob Storage accounts should have soft delete enabled for containersAzure file shares should have soft delete enabledStorage accounts should have geo-redundant storage enabled
164.308(a)(7)(ii)(A) Data backup plan (8 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreKey vaults should have deletion protection enabledKey vaults should have soft delete enabledStorage accounts should have blob versioning enabledAzure Blob Storage accounts should have soft delete enabled for containersAzure file shares should have soft delete enabledStorage accounts should have geo-redundant storage enabled
164.308(a)(7)(ii)(B) Disaster recovery plan (7 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreKey vaults should have deletion protection enabledKey vaults should have soft delete enabledStorage accounts should have blob versioning enabledAzure Blob Storage accounts should have soft delete enabled for containersStorage accounts should have geo-redundant storage enabled
164.308(a)(7)(ii)(C) Emergency mode operation plan (5 controls)
Virtual machines should be protected by Azure BackupVirtual machine backup policies should have daily retention set to the configured minimum or moreKey vaults should have soft delete enabledAzure Blob Storage accounts should have soft delete enabled for containersStorage accounts should have geo-redundant storage enabled
164.308(a)(8) Evaluation (4 controls)
164.310(a)(1) Facility access controls (3 controls)
164.310(d)(1) Device and media controls (5 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredStorage accounts containing operational log containers should use customer-managed keys for encryption
164.312(a)(1) Access control (19 controls)
App Service function apps should have public access restrictions configuredPrivileged Microsoft Entra ID users should have multifactor authentication enabledNetwork security groups should prohibit inbound HTTP (port 80) access from the internetContainer registries should have public network access disabledCosmos DB accounts should use private linkAzure Cosmos DB accounts should have firewall rulesAzure subscriptions should prohibit Custom Subscription Administrator rolesCustom roles should not grant overly permissive subscription permissionsAzure subscriptions should restrict use of the 'User Access Administrator' roleKubernetes clusters should have public access restrictions configuredNetwork security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedAzure Cognitive Search services should have public network access disabledSQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'Storage accounts should have the default network access rule set to denyStorage accounts should have network access restrictions configuredStorage accounts should use virtual network rules to restrict network accessStorage accounts should use private link
164.312(a)(2)(i) Unique user identification (5 controls)
PostgreSQL flexible servers should have Microsoft Entra ID authentication enabledCosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)SQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configuredStorage accounts should have 'Default to Microsoft Entra authorization' enabled
164.312(a)(2)(ii) Emergency access procedure (4 controls)
164.312(a)(2)(iv) Encryption and decryption (13 controls)
Unattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredKey vault keys should have automatic rotation enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionSQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabledStorage accounts should have secure transfer enabled
164.312(b) Audit controls (17 controls)
App Service apps should have 'HTTP logs' enabledAzure subscriptions should have at least one Application Insights resource configuredPostgreSQL flexible servers should have log_connections enabledPostgreSQL flexible servers should have log_disconnections enabledKey vaults should have resource logs enabledAzure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity LogsAzure subscriptions should have an Activity Log Alert configured for Create or Update Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Network Security GroupAzure subscriptions should have an Activity Log Alert configured for Delete Policy AssignmentMySQL flexible servers should have 'audit_log_enabled' set to 'ON'MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'Azure subscriptions should have Network Watcher enabledFlow log resources should have flow logging enabledPostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'SQL servers should have auditing enabledSQL servers should have 'Auditing' retention set to greater than 90 daysSQL servers auditing to storage accounts should have retention set to 90 days or more
164.312(c)(1) Integrity (7 controls)
OS and data disks should use customer-managed keys for encryptionKey vaults should have deletion protection enabledKey vaults should have soft delete enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionStorage accounts should have blob versioning enabledStorage accounts should use customer-managed key for encryptionStorage accounts should have secure transfer enabled
164.312(c)(2) Mechanism to authenticate electronic protected health information (4 controls)
164.312(d) Person or entity authentication (9 controls)
Azure Service Management API should require multifactor authenticationMicrosoft Entra ID tenants should have 'security defaults' enabledNon-privileged Microsoft Entra ID users should have multifactor authentication enabledPrivileged Microsoft Entra ID users should have multifactor authentication enabledMicrosoft Entra ID users with VM access should have multifactor authentication enabledPostgreSQL flexible servers should have Microsoft Entra ID authentication enabledMicrosoft Entra ID conditional access policies should have trusted locations configuredSQL servers should have a Microsoft Entra ID admin configuredSQL servers should have an Azure Active Directory administrator configured
164.312(e)(1) Transmission security (16 controls)
App Service API apps should require FTPS onlyApp Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service apps should have FTP deployments disabledApp Service web apps should require FTPSApp Service web apps should use the latest 'HTTP Version' when used to run the appApp Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessSQL servers should have minimum TLS version set to 1.2 or higherMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMySQL flexible servers should have 'require_secure_transport' set to 'ON'Network security groups should have RDP access restrictions configuredNetwork security groups should have SSH access from the internet restrictedPostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should have secure transfer enabled
164.312(e)(2)(i) Integrity controls (3 controls)
164.312(e)(2)(ii) Encryption (22 controls)
App Service apps should use the latest TLS versionApp Service API apps should require HTTPS for all accessApp Service web apps should use the latest TLS versionApp Service web apps should require HTTPS for all accessSQL servers should have minimum TLS version set to 1.2 or higherUnattached managed disks should be encrypted with ADE or customer-managed keysOS and data disks should use customer-managed keys for encryptionUnattached managed disks should use customer-managed keys (CMK) for encryptionDatabricks workspaces should have a customer-managed key configuredKey vault keys should have automatic rotation enabledStorage accounts containing operational log containers should use customer-managed keys for encryptionMySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higherMySQL flexible servers should have 'require_secure_transport' set to 'ON'PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'SQL databases should have transparent data encryption enabledSQL servers should use customer-managed keys to encrypt data at restSQL databases should have Transparent Data Encryption enabledStorage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryptionStorage accounts should use customer-managed key for encryptionStorage accounts should have infrastructure encryption enabledStorage accounts should have 'Minimum TLS version' set to 'Version 1.2'Storage accounts should have secure transfer enabled
Related Frameworks
NIS2 Directive (EU 2022/2555) — 🟢 High overlap (84%)
BSI C5:2025 — 🟢 High overlap (82%)
RBI Cyber Security Framework for UCBs — 🟢 High overlap (81%)