Google Cloud Compliance FrameworksRetired Frameworks
HIPAA Security Rule 2003
Deprecated Framework
This framework has been superseded by HIPAA Omnibus Final Rule 2013. Organizations should migrate to the 2013 rule, which strengthened privacy and security protections and expanded compliance obligations to business associates.
Best for: A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.
| Mandatory? | Mandatory for covered entities and business associates |
| Who validates? | No formal certification; HHS/OCR enforcement |
| Renewal | No fixed cycle; periodic risk assessments required |
| Scope | Electronic protected health information (ePHI) |
Controls by Category
164.308(a)(1)(ii) Implementation specifications (2 controls)
164.308(a)(1)(ii)(A) Risk analysis (2 controls)
164.308(a)(1)(ii)(B) Risk Management (15 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionCompute Engine instances should not have public IP addressesProjects should prohibit legacy networksKMS keys should be rotated at least annuallyService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledFirewall rules should prohibit unrestricted RDP access from the internetFirewall rules should prohibit unrestricted SSH access from the internetCloud SQL instances should have automated backups configuredCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
164.308(a)(1)(ii)(D) Information system activity review (5 controls)
Projects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log sinks configured for all log entries
164.308(a)(3)(i) Workforce security (16 controls)
Compute Engine instances should not have public IP addressesUser-managed service account keys should be used within the allowed inactivity periodService accounts should use only GCP-managed service account keysService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelIAM users should not hold both service account admin and service account user rolesCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud Storage buckets used for exporting logs should use Bucket Lock
164.308(a)(3)(ii) Implementation specifications (12 controls)
Compute Engine instances should not have public IP addressesIAM users should not have Service Account User or Service Account Token Creator roles at project levelCloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesBigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud Storage buckets used for exporting logs should use Bucket Lock
164.308(a)(4)(i) Information access management (8 controls)
Service accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelOrganizations should have Essential Contacts configuredProjects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readableCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
164.308(a)(5)(ii)(C) Log-in monitoring (2 controls)
164.308(a)(6)(ii) Response and reporting (2 controls)
164.308(a)(7)(i) Contingency plan (1 control)
164.308(a)(7)(ii) Implementation specifications (1 control)
164.308(a)(7)(ii)(A) Data backup plan (2 controls)
164.308(a)(7)(ii)(B) Disaster recovery plan (2 controls)
164.310(a)(1) Facility access controls (2 controls)
164.310(d)(1) Device and media controls (1 control)
164.310(d)(2)(iii) Media re-use (1 control)
164.312(a)(1) Access control (9 controls)
Compute Engine instances should not have public IP addressesService accounts should not have Admin privilegesIAM users should not have Service Account User or Service Account Token Creator roles at project levelProjects should have 'Access Approval' set to 'Enabled'BigQuery tables should not be publicly readableCloud Storage buckets should have Bucket Only Policy enabledCloud SQL instances should prohibit world-readable accessCloud Storage buckets used for exporting logs should prohibit anonymous and public accessCloud Storage buckets should prohibit anonymous and public access
164.312(a)(1) Access control. (8 controls)
Cloud KMS cryptokeys should prohibit anonymous and public accessKMS keys should have separation of duties enforced for KMS-related rolesCloud SQL instances should not have public IP addressesCloud SQL MySQL instances should have 'skip_show_database' set to 'on'Cloud SQL instances should have IP assignment set to privateCloud SQL SQL Server instances should have 'contained database authentication' set to 'off'Cloud SQL SQL Server instances should have 'cross db ownership chaining' set to 'off'Cloud Storage buckets used for exporting logs should use Bucket Lock
164.312(a)(2)(iv) Encryption and decryption (6 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionDataproc clusters should use customer-managed encryption keys for encryptionKMS keys should be rotated at least annuallyCloud KMS encryption keys should have rotation configured within 90 days
164.312(b) Audit controls (12 controls)
Projects should have Cloud Audit Logs properly configured across all services and all usersHTTP(S) load balancers should have logging enabledVPC networks should all have Cloud DNS logging enabledProjects should have log metric filters and alerts configured for Audit Configuration changesProjects should have log metric filters and alerts configured for Custom Role changesProjects should have log metric filters and alerts configured for VPC Network Firewall rule changesProjects should have log metric filters and alerts configured for VPC network changesProjects should have log metric filters and alerts configured for VPC network route changesProjects should have log metric filters and alerts configured for project ownership assignments and changesProjects should have log metric filters and alerts configured for Cloud SQL instance configuration changesProjects should have log metric filters and alerts configured for Cloud Storage IAM permission changesProjects should have log sinks configured for all log entries
164.312(c)(1) Integrity (2 controls)
164.312(d) Person or entity authentication (2 controls)
164.312(e)(1) Transmission security (3 controls)
164.312(e)(2)(i) Integrity controls (2 controls)
164.312(e)(2)(ii) Encryption (7 controls)
BigQuery datasets should all have a default customer-managed encryption key (CMEK) configuredBigQuery tables should all use customer-managed encryption keys (CMEK) for encryptionDisks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryptionDataproc clusters should use customer-managed encryption keys for encryptionKMS keys should be rotated at least annuallyCloud KMS encryption keys should have rotation configured within 90 daysCloud SQL instances should have SSL enabled
Related Frameworks
CIS GCP Benchmark v2.0.0 — 🟢 High overlap (94%)
CIS GCP Benchmark v3.0.0 — 🟢 High overlap (89%)
CIS GCP Benchmark v4.0.0 — 🟢 High overlap (89%)