compliance.tf
Sign inStart Free Trial

HIPAA Compliant Terraform Modules
Enforced Before terraform apply

PHI protection requires encryption at rest and in transit, audit logging, access controls, and backup policies. These modules enforce the Technical Safeguards before you deploy.

If your application handles protected health information (PHI), HIPAA's Security Rule applies to your infrastructure — any AWS resource that touches patient data is in scope. Organizations pursuing HITRUST certification will find these controls map directly to HITRUST CSF requirements.

161

Controls

21

Clauses

34

AWS Modules

Start Free TrialView All Controls

No credit card or AWS account needed to start.

From the team behind terraform-aws-modules. 2B+ provisions worldwide.

IAM · RDS · S3 · EC2 · VPC · ELBSOC 2 Type II CertifiedAvailable on AWS Marketplace

Three Steps to HIPAA Compliant Infrastructure

For terraform-aws-modules users, migration is a one-line change. Same workflow, same interface. Bringing your own modules? We can make those compliant too. Join the beta.

1

Change One Line

main.tf
module "s3" {
- source = "registry.terraform.io/..."
+ source = "hipaa.compliance.tf/..."
 
  bucket = "awesome-docs"
}
2

Run Terraform Commands

terminal
$ terraform init
Initializing modules...
- module.s3 in hipaa.compliance.tf/...
Terraform has been successfully initialized!
$ terraform apply
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
3

Compliance Enforced

§164.312(a) · Public Access Blocked
§164.312(a) · Block Public Read
§164.312(a) · Block Public Write
§164.312(e) · SSL Requests Only
§164.312(e) · Default Encryption
§164.312(e) · KMS Encryption
§164.312(b) · Logging Enabled
§164.308(a) · Versioning Enabled

Every compliance requirement you define is enforced automatically. Nothing to scan, nothing to remediate.

Controls Enforced for HIPAA

161 controls across 21 clauses and AWS services

Enforced (3)Detected (5)
·
  • AWS WAF rules should have CloudWatch metrics enabled

Additional Controls

153 additional controls enforced for HIPAA

Enforced (79)Detected (74)

View full control documentation with implementation details

View HIPAA reference documentation

HIPAA Scope: What We Handle vs. What You Own

compliance.tf handles the infrastructure configuration layer for HIPAA. Here is what it covers and what stays with your team.

compliance.tf Enforces for HIPAA

  • Technical safeguard controls (encryption, access controls, audit logging)
  • HIPAA Security Rule section mapping (§164.312, §164.308)
  • Deployment-time evidence generation via AWS-native tools
  • Upstream module updates (terraform-aws-modules kept in sync)
  • Exception management with audit trail
  • Control documentation and safeguard mapping matrices

See which modules are covered

View HIPAA reference documentation

Your Team Still Handles for HIPAA

  • Business Associate Agreements (BAA) execution and management
  • Workforce training and security awareness programs
  • Physical safeguards for facilities and workstations
  • Breach notification procedures and timelines
  • Administrative policies and procedures documentation
  • Risk analysis and risk management programs
  • Patient rights and access request handling

compliance.tf handles Technical Safeguard requirements that map to AWS resource configuration. Administrative and Physical Safeguards remain your organization's responsibility.

HIPAA Audit Evidence, Generated Automatically

Your auditor does not need to trust compliance.tf. Evidence comes from AWS-native tools they already accept.

Evidence your auditor already trusts

Every compliance.tf module enforces controls at deploy time. When AWS Config, Security Hub, or Audit Manager evaluates your resources, they report clean findings because the controls are built into the modules, not bolted on after the fact.

  • AWS Config rules validate resource configuration continuously
  • Security Hub aggregates findings across accounts and regions
  • Audit Manager generates assessment reports mapped to HIPAA
  • Downloadable control mapping matrices for your auditor
evidence.json
{
  "framework": "HIPAA",
  "clause": "§164.312(e)",
  "control": "s3_bucket_ssl_requests_only",
  "status": "COMPLIANT",
  "source": "AWS Config",
  "resource": "arn:aws:s3:::awesome-docs",
  "evaluated": "2026-03-04T10:30:00Z"
}

Prevention vs. Detection for HIPAA

compliance.tf prevents non-compliant deployments. Scanning tools detect them after the fact. Most mature programs use both.

DimensionIaC Scanning
Checkov / Trivy / Prowler		compliance.tf
Prevents non-compliant configs before terraform applyNo (post-plan scan)Yes
Maps controls to framework clause IDsPartialYes
Produces auditor-accepted evidence (AWS-native)Scan reports onlyYes
Exception management with audit trailSuppression rulesYes
Same interface as terraform-aws-modulesN/AYes
Keeps pace with upstream module updatesN/AYes
Catches runtime drift / console changesYesNo
Covers non-Terraform resourcesYesNo
Internal engineering timeMediumLow

We recommend keeping scanning tools active alongside compliance.tf for defense in depth. The scanner validates what compliance.tf already enforces.

HIPAA Compliance Questions

Does compliance.tf sign BAAs?

No. compliance.tf is a software tool that enforces infrastructure controls in Terraform modules — it does not store, process, or transmit PHI. You need BAAs with AWS (as your cloud provider) and with any service that handles PHI. compliance.tf ensures your AWS resources are configured to meet HIPAA Technical Safeguard requirements.

Which HIPAA safeguards does this cover?

compliance.tf maps controls to the HIPAA Security Rule Technical Safeguards (§164.312) and relevant Administrative Safeguards (§164.308). These cover access controls, audit controls, integrity controls, transmission security, and encryption. Physical Safeguards and most Administrative Safeguards are organizational and remain your responsibility.

Does this help with HITRUST certification?

Yes. HITRUST CSF incorporates HIPAA Security Rule requirements, so the Technical Safeguard controls enforced by compliance.tf modules map directly to HITRUST CSF control objectives. While HITRUST certification requires broader organizational controls beyond infrastructure, having compliant AWS resources satisfies the infrastructure configuration requirements that HITRUST assessors evaluate.

How is this different from Checkov, Trivy, or Prowler?

Those tools are detective controls. They scan infrastructure after you write it and report findings you fix manually. compliance.tf is a preventive control. The modules themselves cannot produce non-compliant resources. There is nothing to scan, nothing to remediate. Most teams keep their scanners running alongside compliance.tf for defense in depth.

Can I adopt this gradually, or is it all-or-nothing?

Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes — you’re only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.

Will my auditor accept this as evidence?

Your auditor does not need to trust compliance.tf directly. Evidence comes from AWS-native tools they already accept: AWS Config, Security Hub, and Audit Manager. We enforce controls at deploy time so those AWS tools always report clean findings.

What if I want to switch back or compliance.tf shuts down?

Our modules are standard Terraform. They work with Terraform, OpenTofu, Terragrunt, Terramate, and any tool that speaks the Terraform module protocol. Every module is a drop-in replacement for its upstream terraform-aws-modules equivalent with the same variables and outputs. Change your module source line back, run terraform init. Your infrastructure does not change. No lock-in, no proprietary state.

Start Deploying HIPAA-Compliant Infrastructure

$100/year for all 34 modules, all frameworks. 30-day free trial.

Start Free TrialContact Sales

No credit card required. Switch back at any time.

Stay Informed About New Features

Join the mailing list for releases, new modules, and roadmap updates. No spam. Unsubscribe anytime.

Not convinced yet or dying for a feature we don't have? Send us an email — we really want to hear your feedback!