HIPAA Omnibus Rule 2013
ActiveCore framework
Best for: Any covered entity or business associate that creates, receives, maintains, or transmits electronic protected health information (ePHI). This includes hospitals, health plans, healthcare clearinghouses, and their subcontractors. If you run infrastructure on AWS for a healthcare client, you are likely a business associate and must comply. There is no revenue or size threshold.
| Mandatory? | Mandatory for covered entities and business associates |
|---|---|
| Who validates? | No formal certification; HHS/OCR enforcement |
| Renewal | No fixed cycle; periodic risk assessments required |
| Scope | Protected health information (PHI) across covered entities and BAs |
| Governing body | U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), HIPAA Omnibus Rule 2013. Official source |
Get started
Point the module source at the HIPAA Omnibus Rule 2013 endpoint and pin a version range you reviewed:
module "..." {
source = "hipaa.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}hipaa.compliance.tf lists every HIPAA Omnibus Rule 2013 module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Audit Logging and Monitoring | Validates CloudTrail configuration across regions, S3 object-level event logging for both read and write operations, API Gateway stage logging, X-Ray tracing, and CloudFront access logs. These map directly to Section 164.312(b) audit control requirements. | Defining log retention periods, reviewing audit logs on a regular schedule, configuring alerts for suspicious access to ePHI, and documenting your log review procedures. You also need to ensure logs are protected from tampering per Section 164.312(c)(2). |
| Encryption in Transit | Checks SSL certificate assignment on API Gateway stages, CloudFront HTTPS enforcement, and ACM certificate expiration within 30 days. Covers Section 164.312(e)(1) transmission security requirements for AWS-managed endpoints. | Enforcing TLS minimum version policies (TLS 1.2 or higher), managing certificate rotation for non-ACM certificates, and encrypting ePHI transmissions that occur outside AWS (for example, SFTP to partners or email encryption). |
| Encryption at Rest | Validates encryption on API Gateway stage caches and AWS Backup recovery points. | KMS key access policies, key rotation schedules, documenting which encryption method applies to each data store, and managing encryption for on-premises or hybrid systems outside AWS. |
| Backup and Contingency Planning | Enforces minimum 35-day retention on backup plans and recovery points, verifies encryption on recovery points, and confirms manual deletion is disabled. Maps to Section 164.308(a)(7) contingency plan requirements. | Testing restore procedures periodically, documenting your disaster recovery plan, maintaining an emergency mode operations plan, and confirming that your retention periods satisfy the 6-year HIPAA documentation requirement where applicable. |
| Network Access Control | Confirms Auto Scaling launch configurations do not assign public IPs and that load-balanced Auto Scaling groups use health checks. Validates basic network isolation controls under Section 164.312(a)(1). | Implementing VPC segmentation for ePHI workloads, configuring security groups and NACLs, managing VPN or Direct Connect for administrative access, and documenting your network architecture in a data flow diagram. |
Controls by category
70 of 104 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 34 are Mapped only: HIPAA Omnibus Rule 2013 lists them, no compliance.tf module checks them.
Audit Controls (Section 164.312(b))
Section 164.312(b) requires hardware, software, and procedural mechanisms that record and examine activity in systems containing ePHI. Assessors will want CloudTrail enabled across all regions with object-level logging on S3 buckets that store ePHI. The most common gap: CloudTrail active at the account level but data-plane events missing for S3 read and write operations, which leaves material holes in the access audit trail.
Contingency Plan (Section 164.308(a)(7))
Do backup plans exist, are recovery points retained long enough, and can they be deleted before their retention period expires? Those three questions drive most 164.308(a)(7) findings. HIPAA's 6-year retention under 45 CFR 164.316(b)(2) covers Security Rule documentation, not ePHI backups, so set backup retention in your contingency plan. Manually deletable recovery points come up repeatedly in organizations that haven't thought through insider threat or ransomware scenarios.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Encryption at Rest (Section 164.312(a)(2)(iv))
The first thing an assessor examines is whether encryption is enabled by default, not applied retroactively after a finding. ePHI in caches, backups, databases, and object stores all need AES-256 or equivalent, and KMS key policies get scrutinized. Unencrypted backup recovery points are a persistent gap: organizations encrypt primary storage and miss the backup vault entirely.
| Control | Status |
|---|---|
| API Gateway stages should have cache encryption at rest enabled | Mapped |
Transmission Security (Section 164.312(e)(1))
Every endpoint transmitting ePHI needs TLS enforcement, and assessors will check certificate validity, expiration dates, and whether plaintext HTTP is blocked or redirected. Expired ACM certificates are a frequent finding because automated renewal sometimes fails for imported or DNS-validated certificates that have lost their validation records.
Additional controls (96)
AWS CloudTrail (3)
AWS CodeBuild (1)
| Control | Status |
|---|---|
| CodeBuild projects should have logging enabled | Mapped |
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS IAM (8)
AWS KMS (1)
| Control | Status |
|---|---|
| KMS CMK rotation should be enabled | Enforced |
AWS Lambda (4)
AWS Secrets Manager (1)
| Control | Status |
|---|---|
| Secrets Manager secrets should be encrypted using CMK | Enforced |
AWS WAF (1)
| Control | Status |
|---|---|
| WAFv2 rules should have CloudWatch metrics enabled | Enforced |
Amazon CloudWatch (2)
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DynamoDB (3)
Amazon DynamoDB Accelerator (1)
| Control | Status |
|---|---|
| DynamoDB Accelerator (DAX) clusters should be encrypted at rest | Mapped |
Amazon EBS (1)
| Control | Status |
|---|---|
| Attached EBS volumes should have encryption enabled | Enforced |
Amazon EC2 (6)
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS file systems should have encryption at rest enabled | Enforced |
| EFS file systems should be encrypted with CMK | Enforced |
Amazon EKS (1)
Amazon EMR (1)
| Control | Status |
|---|---|
| EMR cluster Kerberos should be enabled | Mapped |
Amazon ElastiCache (1)
Amazon OpenSearch Service (4)
Amazon RDS (14)
Amazon Redshift (8)
Amazon S3 (13)
Amazon SNS (1)
| Control | Status |
|---|---|
| SNS topics should be encrypted at rest | Enforced |
Amazon SageMaker (3)
Amazon VPC (3)
Elastic Load Balancing (7)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIST Cybersecurity Framework v1.1 | High 93% | |
| NIST SP 800-171 Rev 2 | High 88% | |
| PCI DSS v4.0 | High 86% |
Frequently asked questions
Does HIPAA apply to my organization if we only host infrastructure for a healthcare client but never view the data?
Yes. The 2013 Omnibus Rule extended HIPAA obligations directly to business associates, defined as any entity that creates, receives, maintains, or transmits ePHI on behalf of a covered entity. Hosting infrastructure that stores ePHI makes you a business associate even if your staff never access the data. You must sign a Business Associate Agreement (BAA) and comply with the applicable Security Rule provisions. AWS offers a BAA, but configuring your resources to meet HIPAA requirements stays with you.
Is there a HIPAA certification or audit report I can obtain?
No official HIPAA certification exists. Unlike PCI DSS or SOC 2, no accredited body issues a HIPAA compliance certificate. Compliance is typically demonstrated through internal risk assessments, third-party security assessments, and documentation. Some organizations pursue HITRUST CSF certification as a proxy, since HITRUST incorporates HIPAA requirements. OCR audits are investigatory, not certifying.
How does the Omnibus Rule change breach notification requirements compared to the original HITECH Act rules?
The Omnibus Rule replaced the 'significant risk of financial, reputational, or other harm' standard with a presumption that any impermissible use or disclosure of unsecured ePHI is a breach. The burden shifted to the covered entity to demonstrate a 'low probability that PHI has been compromised' using a four-factor risk assessment per 45 CFR 164.402, which makes the notification threshold lower and harder to avoid. Affected individuals must be notified within 60 days of discovery, and breaches involving 500 or more individuals require notification to OCR and local media outlets.
What are the penalties for non-compliance?
The Omnibus Rule adopted a four-tier penalty structure under 45 CFR 160.404. Tier 1 (lack of knowledge): $100 to $50,000 per violation. Tier 2 (reasonable cause): $1,000 to $50,000 per violation. Tier 3 (willful neglect, corrected): $10,000 to $50,000 per violation. Tier 4 (willful neglect, not corrected): $50,000 per violation. The annual cap per identical provision is $1.5 million, adjusted for inflation and currently above $2 million. Criminal penalties up to $250,000 and imprisonment apply under 42 USC 1320d-6.
How frequently should I run these automated controls against my AWS environment?
Run the checks at least weekly, with critical controls (encryption, logging, public access) checked daily or via continuous monitoring. The Security Rule requires ongoing risk management per 45 CFR 164.308(a)(1)(ii)(B), not point-in-time snapshots. Run the checks in your CI/CD pipeline to catch misconfigurations before they reach production, and keep the results with your Security Rule documentation for six years (45 CFR 164.316(b)(2)).