HIPAA Security Rule 2003

Active

Best for: A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of the Security Rule with respect to electronic protected health information. It applies to healthcare providers, health plans, and healthcare clearinghouses.

Mandatory?	Mandatory for covered entities and business associates
Who validates?	No formal certification; HHS/OCR enforcement
Renewal	No fixed cycle; periodic risk assessments required
Scope	Electronic protected health information (ePHI)

Controls by category

115 controls are Mapped to HIPAA Security Rule 2003.

164.308(a)(1)(ii)(A) Risk analysis

Control	Status
Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default	Mapped
Azure subscriptions should have Microsoft Defender for Containers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Azure Cosmos DB enabled	Mapped
Azure subscriptions should have Azure Defender for DNS enabled	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled	Mapped

164.308(a)(1)(ii)(B) Risk Management

Control	Status
Azure subscriptions should have a custom role for administering resource locks	Mapped
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Unattached managed disks should be encrypted with ADE or customer-managed keys	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Unattached managed disks should use customer-managed keys (CMK) for encryption	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Key vault keys should have automatic rotation enabled	Mapped
Key vaults should have Role-Based Access Control (RBAC) enabled	Mapped
Azure Key Vaults should use private link	Mapped
Kubernetes cluster nodes should prohibit public access	Mapped
Kubernetes clusters should have public access restrictions configured	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Network security groups should have UDP services restricted from the internet	Mapped
SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped

164.308(a)(1)(ii)(D) Information system activity review

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped
Azure subscriptions should have at least one Application Insights resource configured	Mapped
Key vaults should have resource logs enabled	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped
SQL servers should have auditing enabled	Mapped
SQL servers should have 'Auditing' retention set to greater than 90 days	Mapped
SQL servers auditing to storage accounts should have retention set to 90 days or more	Mapped

164.308(a)(3)(i) Workforce security

Control	Status
App Service function apps should have public access restrictions configured	Mapped
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)	Mapped

164.308(a)(3)(ii)(A) Authorization and/or supervision

Control	Status
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped
Key vaults should have resource logs enabled	Mapped

164.308(a)(3)(ii)(B) Workforce clearance procedure

Control	Status
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Azure subscriptions should have a custom role for administering resource locks	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped

164.308(a)(4)(i) Information access management

Control	Status
Microsoft Entra ID policies should have 'User consent for applications' set to 'Do not allow user consent'	Mapped
Microsoft Entra ID policies should have 'User consent for applications' set to 'Allow user consent for apps from verified publishers, for selected permissions'	Mapped
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Azure subscriptions should have a custom role for administering resource locks	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Key vaults should have Role-Based Access Control (RBAC) enabled	Mapped

164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Cosmos DB accounts should use private link	Mapped
Databricks workspaces should have a customer-managed key configured	Mapped
Databricks workspaces should be in a customer-managed virtual network	Mapped
Key vaults should have resource logs enabled	Mapped
Azure Key Vaults should use private link	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped

164.308(a)(4)(ii)(B) Access authorization

Control	Status
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Azure subscriptions should have a custom role for administering resource locks	Mapped
Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Key vaults should have Role-Based Access Control (RBAC) enabled	Mapped
Kubernetes clusters should use Role-Based Access Control (RBAC)	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

164.308(a)(4)(ii)(C) Access establishment and modification

Control	Status
Microsoft Entra ID tenants should limit Global Administrators to fewer than 5	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Microsoft Entra ID policies should have 'Users can create security groups in Azure portals, API or PowerShell' set to 'No'	Mapped
Microsoft Entra ID policies should have 'Users Can Register Applications' set to 'No'	Mapped

164.308(a)(5)(ii)(B) Protection from malicious software

Control	Status
Virtual machines should have endpoint protection installed	Mapped
Running container images should have no unresolved vulnerabilities	Mapped
Virtual machines should have system updates installed	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have Microsoft Defender for Cloud container image scanning enabled	Mapped
Security Center should have Windows Defender ATP (WDATP) integration selected	Mapped

164.308(a)(5)(ii)(C) Log-in monitoring

Control	Status
Key vaults should have resource logs enabled	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped
Microsoft Defender for Cloud should have Microsoft Defender for Cloud Apps (MCAS) integration selected	Mapped
SQL servers should have auditing enabled	Mapped

164.308(a)(5)(ii)(D) Password management

Control	Status
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
RBAC key vaults should have 'Expiration Date' configured for all secrets	Mapped
Storage accounts should each have 'Enable key rotation reminders' enabled	Mapped

164.308(a)(6)(i) Security incident procedures

Control	Status
Security contacts should have attack path email notifications enabled at the configured minimum risk level	Mapped
Azure subscriptions should have an Activity Log alert for Service Health incidents	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Security Solution	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped

164.308(a)(6)(ii) Response and reporting

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Flow log resources should have flow logging enabled	Mapped
Microsoft Defender for Cloud settings should have 'Additional email addresses' configured with a security contact email	Mapped
Azure subscriptions should have Microsoft Defender for Servers enabled	Mapped
Azure subscriptions should have email notifications for high severity alerts enabled	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
SQL servers should have auditing enabled	Mapped

164.308(a)(7)(i) Contingency plan

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Storage accounts should have blob versioning enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped
Azure file shares should have soft delete enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

164.308(a)(7)(ii)(A) Data backup plan

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Storage accounts should have blob versioning enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped
Azure file shares should have soft delete enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

164.308(a)(7)(ii)(B) Disaster recovery plan

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Storage accounts should have blob versioning enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

164.308(a)(7)(ii)(C) Emergency mode operation plan

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have soft delete enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

164.308(a)(8) Evaluation

Control	Status
Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default	Mapped
SQL servers should have vulnerability assessment enabled	Mapped
SQL servers should have VA 'Periodic Recurring Scans' enabled	Mapped
SQL servers should have VA 'Send scan reports to' configured	Mapped

164.310(a)(1) Facility access controls

Control	Status
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped

164.310(d)(1) Device and media controls

Control	Status
Unattached managed disks should be encrypted with ADE or customer-managed keys	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Unattached managed disks should use customer-managed keys (CMK) for encryption	Mapped
Databricks workspaces should have a customer-managed key configured	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped

164.312(a)(1) Access control

Control	Status
App Service function apps should have public access restrictions configured	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Network security groups should prohibit inbound HTTP (port 80) access from the internet	Mapped
Container registries should have public network access disabled	Mapped
Cosmos DB accounts should use private link	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Azure subscriptions should prohibit Custom Subscription Administrator roles	Mapped
Custom roles should not grant overly permissive subscription permissions	Mapped
Azure subscriptions should restrict use of the 'User Access Administrator' role	Mapped
Kubernetes clusters should have public access restrictions configured	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
Azure Cognitive Search services should have public network access disabled	Mapped
SQL databases should prohibit ingress from 0.0.0.0/0 (ANY IP)	Mapped
Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Storage accounts should use private link	Mapped

164.312(a)(2)(i) Unique user identification

Control	Status
PostgreSQL flexible servers should have Microsoft Entra ID authentication enabled	Mapped
Cosmos DB accounts should have 'Access Control' configured to use Azure Active Directory (AAD) and Role-Based Access Control (RBAC)	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped
Storage accounts should have 'Default to Microsoft Entra authorization' enabled	Mapped

164.312(a)(2)(ii) Emergency access procedure

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Virtual machine backup policies should have daily retention set to the configured minimum or more	Mapped
Key vaults should have soft delete enabled	Mapped
Azure Blob Storage accounts should have soft delete enabled for containers	Mapped

164.312(a)(2)(iv) Encryption and decryption

Control	Status
Unattached managed disks should be encrypted with ADE or customer-managed keys	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Unattached managed disks should use customer-managed keys (CMK) for encryption	Mapped
Databricks workspaces should have a customer-managed key configured	Mapped
Key vault keys should have automatic rotation enabled	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should have secure transfer enabled	Mapped

164.312(b) Audit controls

Control	Status
App Service apps should have 'HTTP logs' enabled	Mapped
Azure subscriptions should have at least one Application Insights resource configured	Mapped
PostgreSQL flexible servers should have log_connections enabled	Mapped
PostgreSQL flexible servers should have log_disconnections enabled	Mapped
Key vaults should have resource logs enabled	Mapped
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs	Mapped
Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group	Mapped
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment	Mapped
MySQL flexible servers should have 'audit_log_enabled' set to 'ON'	Mapped
MySQL flexible servers should have 'audit_log_events' configured to include 'CONNECTION'	Mapped
Azure subscriptions should have Network Watcher enabled	Mapped
Flow log resources should have flow logging enabled	Mapped
PostgreSQL flexible servers should have 'log_checkpoints' set to 'ON'	Mapped
SQL servers should have auditing enabled	Mapped
SQL servers should have 'Auditing' retention set to greater than 90 days	Mapped
SQL servers auditing to storage accounts should have retention set to 90 days or more	Mapped

164.312(c)(1) Integrity

Control	Status
OS and data disks should use customer-managed keys for encryption	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
Storage accounts should have blob versioning enabled	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have secure transfer enabled	Mapped

164.312(c)(2) Mechanism to authenticate electronic protected health information

Control	Status
Key vaults should have resource logs enabled	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
Storage accounts should have blob versioning enabled	Mapped
Storage accounts should have secure transfer enabled	Mapped

164.312(d) Person or entity authentication

Control	Status
Azure Service Management API should require multifactor authentication	Mapped
Microsoft Entra ID tenants should have 'security defaults' enabled	Mapped
Non-privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Privileged Microsoft Entra ID users should have multifactor authentication enabled	Mapped
Microsoft Entra ID users with VM access should have multifactor authentication enabled	Mapped
PostgreSQL flexible servers should have Microsoft Entra ID authentication enabled	Mapped
Microsoft Entra ID conditional access policies should have trusted locations configured	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

164.312(e)(1) Transmission security

Control	Status
App Service API apps should require FTPS only	Mapped
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
App Service apps should have FTP deployments disabled	Mapped
App Service web apps should require FTPS	Mapped
App Service web apps should use the latest 'HTTP Version' when used to run the app	Mapped
App Service web apps should use the latest TLS version	Mapped
App Service web apps should require HTTPS for all access	Mapped
SQL servers should have minimum TLS version set to 1.2 or higher	Mapped
MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher	Mapped
MySQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
Network security groups should have RDP access restrictions configured	Mapped
Network security groups should have SSH access from the internet restricted	Mapped
PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'	Mapped
Storage accounts should have secure transfer enabled	Mapped

164.312(e)(2)(i) Integrity controls

Control	Status
Key vaults should have resource logs enabled	Mapped
Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'	Mapped
Storage accounts should have secure transfer enabled	Mapped

164.312(e)(2)(ii) Encryption

Control	Status
App Service apps should use the latest TLS version	Mapped
App Service API apps should require HTTPS for all access	Mapped
App Service web apps should use the latest TLS version	Mapped
App Service web apps should require HTTPS for all access	Mapped
SQL servers should have minimum TLS version set to 1.2 or higher	Mapped
Unattached managed disks should be encrypted with ADE or customer-managed keys	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Unattached managed disks should use customer-managed keys (CMK) for encryption	Mapped
Databricks workspaces should have a customer-managed key configured	Mapped
Key vault keys should have automatic rotation enabled	Mapped
Storage accounts containing operational log containers should use customer-managed keys for encryption	Mapped
MySQL flexible servers should have 'tls_version' set to 'TLSv1.2' or higher	Mapped
MySQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
PostgreSQL flexible servers should have 'require_secure_transport' set to 'ON'	Mapped
SQL databases should have transparent data encryption enabled	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
SQL databases should have Transparent Data Encryption enabled	Mapped
Storage accounts containing VHD OS disks should use customer-managed keys (CMK) for encryption	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped
Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'	Mapped
Storage accounts should have secure transfer enabled	Mapped

Framework	Control overlap	Note
NIS2 Directive (EU 2022/2555)	High 84%
BSI C5:2025	High 82%
RBI Cyber Security Framework for UCBs	High 81%

Frequently asked questions

Who must comply with the HIPAA Security Rule?

A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of `Subpart C` with respect to the electronic protected health information of a covered entity.

What is the difference between required and addressable implementation specifications?

A required specification must be implemented. For an addressable one, the entity assesses whether it is reasonable and appropriate. If it is, the entity implements it. If not, the entity documents why not and implements an equivalent alternative measure if reasonable and appropriate.

Does a HIPAA certification program exist for cloud providers?

There is currently no certification program approved by the US Department of Health and Human Services through which a cloud service provider acting as a business associate could demonstrate compliance with HIPAA and the HITECH Act.

Does using Azure make a cloud solution HIPAA compliant?

Using Azure does not automatically impart compliance onto your cloud solutions. Your organization is responsible for an adequate compliance program and internal processes, and for ensuring that your use of Azure aligns with HIPAA and the HITECH Act.