HIPAA controls built into your Terraform modules. Enforced before apply.
PHI on AWS needs encryption at rest and in transit, audit logging, access controls and backups. The modules enforce these controls before apply and list the HIPAA Security Rule section each one maps to, where the catalog names one.
Modules enforce 75 of 102 HIPAA controls in the catalog. Of the 80 that cite a HIPAA clause, they enforce 57. The controls they do not enforce stay with your team, with BAAs, workforce training, risk analysis and breach notification.
No credit card or AWS account needed to start. By Anton Babenko, maintainer of terraform-aws-modules, more than 2 billion provisions.
Annex C: HIPAA
- Framework
- HIPAA Security Rule, Omnibus Rule 2013
- For
- Your team, on Terraform
Scope for HIPAA
If your application handles protected health information (PHI), the Security Rule applies to every AWS resource that touches it. If you are pursuing HITRUST, these controls also map to HITRUST CSF requirements; the certification still needs your organizational controls.
Covers
- Infrastructure controls on AWS resources that map to HIPAA Security Rule sections, by section in C.3.
- terraform-aws-modules through the HIPAA framework host or your org endpoint, and resources written by hand outside modules once your team switches to the compliance.tf provider.
Stays with your team
- Business Associate Agreements. Compliance.tf does not store, process or transmit PHI and signs no BAA; you need one with AWS and with each service that handles PHI.
- Workforce training and security awareness.
- Physical safeguards for facilities and workstations.
- Breach notification procedures and timelines.
- Administrative policies and procedures.
- Risk analysis and risk management.
- Patient rights and access requests.
- Resources outside compliance.tf module coverage, and every control C.4 lists as Mapped: 23 with a HIPAA clause and 4 without one.
The source line
Point a module at the HIPAA framework host. Same inputs and outputs, no state migration. Terraform 1.0 or later.
- source = "terraform-aws-modules/s3-bucket/aws" + source = "hipaa.compliance.tf/terraform-aws-modules/s3-bucket/aws" version = "~> 5.0"
With an org endpoint, the source names your org host instead, and HIPAAcomes from your org's configuration.
Enforced and mapped, by section
Of the 80 HIPAA controls in the documented catalog that cite a clause, modules enforce 57. A control appears once under each section it maps to.
The catalog maps 22 more controls to HIPAA without naming a clause, 18 of them enforced. They are listed apart at the end of C.4 and left out of these counts.
Every row is a control your auditor can look up.
Filter the register, or search by control name or clause, for example 164.312(b).
80 of 80 shown
Each control links to its public docs page.
- Enforced
- Modules set this control before anything is deployed.
- Mapped
- Documented on its docs page, not set by modules. Your team owns it.
Control register
Enforced or mapped without a named HIPAA clause
The catalog lists these 22 controls under HIPAA but names no HIPAA clause for them, so the register and the counts in C.3 leave them out. Each still links to its docs page.
Clause IDs for the auditor. Your stack stays as it is.
Compliance.tf works alongside your scanners, plan policy, CSPM and GRC tool. It sets the controls in the modules and lists the clause each one is there for.
Evidence
What compliance.tf gives your auditor
- The HIPAA clause IDs behind each enforced setting, with stable control IDs and public docs pages.
- The config snapshot bound to each environment, and the per-action audit log of promotions between environments.
What comes from your AWS account and GRC tool
Evidence of what actually runs comes from your own account, for example AWS Config and your CSPM. Your GRC tool keeps tracking policies and audit workflows.
Related reading
Make Non-Compliant Terraform Impossible, Verifying Compliance.tf Modules, the comparisons with other tools, and the HIPAA framework registry at hipaa.compliance.tf.
Plans for HIPAA
HIPAA is in the 30-day trial and in Full Access, $1,000 a year on AWS Marketplace. Schedule of fees.
Questions about HIPAA
Which HIPAA safeguards does this cover?
Compliance.tf maps controls to HIPAA Security Rule sections, for example the Technical Safeguards (164.312) and Administrative Safeguards (164.308). These cover access controls, audit controls, integrity controls, transmission security, and encryption. Physical Safeguards (164.310) and the organizational parts of the Administrative Safeguards remain your responsibility.
Can I adopt this gradually, or is it all-or-nothing?
Fully incremental. Start with one module in one environment. Your existing modules continue working untouched. If you use Terragrunt or Terramate to orchestrate your runs, nothing changes - you're only swapping the module source line. There is no global policy agent to deploy, no wrapper binary, no sidecar. Each module source line is independent.
What if we want to switch back?
Each module keeps the inputs and outputs of its terraform-aws-modules counterpart and needs no state migration, so switching back is the same source line change in reverse.