HIPAA Security Rule 2003
Active
Best for: A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.
| Mandatory? | Mandatory for covered entities and business associates |
|---|---|
| Who validates? | No formal certification; HHS/OCR enforcement |
| Renewal | No fixed cycle; periodic risk assessments required |
| Scope | Electronic protected health information (ePHI) |
Controls by category
47 controls are Mapped to HIPAA Security Rule 2003.
164.308(a)(1)(ii) Implementation specifications
164.308(a)(1)(ii)(A) Risk analysis
164.308(a)(1)(ii)(B) Risk Management
164.308(a)(1)(ii)(D) Information system activity review
164.308(a)(3)(i) Workforce security
164.308(a)(3)(ii) Implementation specifications
164.308(a)(4)(i) Information access management
164.308(a)(5)(ii)(C) Log-in monitoring
164.308(a)(6)(ii) Response and reporting
164.308(a)(7)(i) Contingency plan
| Control | Status |
|---|---|
| Cloud SQL instances should have automated backups configured | Mapped |
164.308(a)(7)(ii) Implementation specifications
| Control | Status |
|---|---|
| Cloud SQL instances should have automated backups configured | Mapped |
164.308(a)(7)(ii)(A) Data backup plan
164.308(a)(7)(ii)(B) Disaster recovery plan
164.310(a)(1) Facility access controls
164.310(d)(1) Device and media controls
164.310(d)(2)(iii) Media re-use
| Control | Status |
|---|---|
| Projects should have Cloud Asset Inventory enabled | Mapped |
164.312(a)(1) Access control
164.312(a)(1) Access control.
164.312(a)(2)(iv) Encryption and decryption
164.312(b) Audit controls
164.312(c)(1) Integrity
164.312(d) Person or entity authentication
164.312(e)(1) Transmission security
164.312(e)(2)(i) Integrity controls
164.312(e)(2)(ii) Encryption
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| CIS GCP Benchmark v2.0.0 | High 94% | |
| CIS GCP Benchmark v3.0.0 | High 89% | |
| CIS GCP Benchmark v4.0.0 | High 89% |
Frequently asked questions
Who must comply with the HIPAA Security Rule standards?
A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of Subpart C with respect to electronic protected health information of a covered entity.
What is the difference between required and addressable implementation specifications?
If a specification is required, the entity must implement it. For an addressable one, the entity must assess whether it is reasonable and appropriate. If so, it implements the specification. If not, it documents why and implements an equivalent alternative measure if reasonable and appropriate.
Who is responsible for building a HIPAA compliant solution on Google Cloud?
The covered entity that enters into the BAA with Google Cloud is responsible for building a HIPAA compliant solution using the approved Google Cloud services. After the solution is built, the covered entity is responsible for implementing compliance controls.
Can the Google Cloud BAA be modified?
The BAA is not subject to modification. Organizations that want to execute a BAA should talk to their account managers about entering into one.