Skip to content

HIPAA Security Rule 2003

Deprecated Framework

This framework has been superseded by HIPAA Omnibus Final Rule 2013. Organizations should migrate to the 2013 rule, which strengthened privacy and security protections and expanded compliance obligations to business associates.

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, published in February 2003, establishes national standards to protect electronic protected health information (ePHI). Enforced by the U.S. Department of Health and Human Services (HHS), this rule requires covered entities to implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI. It applies to all healthcare providers, health plans, and healthcare clearinghouses in the United States.

Terraform Registry Subdomain: hipaasecurity2003

module "..." {
  source  = "hipaasecurity2003.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://hipaasecurity2003.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with HIPAA Security Rule 2003 compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://hipaasecurity2003.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_stage_cache_encryption_at_rest_enabled,apigateway_stage_logging_enabled"
}