Skip to content

HIPAA Omnibus Rule 2013

The Health Insurance Portability and Accountability Act (HIPAA) Omnibus Final Rule of 2013 strengthened privacy and security protections for health information established under HIPAA. Enforced by the U.S. Department of Health and Human Services (HHS), this rule expanded the scope of protected health information, increased penalties for violations, and extended compliance obligations to business associates. It applies to all covered entities and business associates handling protected health information in the United States.

Terraform Registry Subdomain: hipaa

module "..." {
  source  = "hipaa.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://hipaa.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with HIPAA Omnibus Rule 2013 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://hipaa.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_rest_api_stage_xray_tracing_enabled"
}