Conformidade com a HIPAA

Implemente os requisitos da Regra de Segurança, Regra de Privacidade e Regra de Notificação de Violação da HIPAA para sistemas que criam, recebem, mantêm ou transmitem Informações de Saúde Protegidas Eletrônicas (ePHI).

Quando Usar

• Construindo ou operando sistemas que lidam com Informações de Saúde Protegidas Eletrônicas
• Configurando infraestrutura de nuvem para cargas de trabalho elegíveis para HIPAA
• Estabelecendo Acordos de Associado Comercial com fornecedores
• Implementando salvaguardas técnicas para proteção de PHI
• Preparando-se para auditorias de conformidade com a HIPAA ou investigações do OCR

Regras e Salvaguardas da HIPAA

security_rule:
  administrative_safeguards:
    164.308_a_1: "Security Management Process"
    actions:
      - Conduct risk analysis (required)
      - Implement risk management program (required)
      - Apply sanction policy for violations (required)
      - Review information system activity (required)

    164.308_a_3: "Workforce Security"
    actions:
      - Authorization/supervision procedures (addressable)
      - Workforce clearance procedure (addressable)
      - Termination procedures (addressable)

    164.308_a_4: "Information Access Management"
    actions:
      - Access authorization policies (addressable)
      - Access establishment and modification (addressable)
      - Isolate healthcare clearinghouse functions (required)

    164.308_a_5: "Security Awareness and Training"
    actions:
      - Security reminders (addressable)
      - Protection from malicious software (addressable)
      - Log-in monitoring (addressable)
      - Password management (addressable)

    164.308_a_6: "Security Incident Procedures"
    actions:
      - Response and reporting procedures (required)

    164.308_a_7: "Contingency Plan"
    actions:
      - Data backup plan (required)
      - Disaster recovery plan (required)
      - Emergency mode operation plan (required)
      - Testing and revision procedures (addressable)
      - Applications and data criticality analysis (addressable)

    164.308_a_8: "Evaluation"
    actions:
      - Periodic technical and nontechnical evaluation (required)

  physical_safeguards:
    164.310_a: "Facility Access Controls"
    164.310_b: "Workstation Use"
    164.310_c: "Workstation Security"
    164.310_d: "Device and Media Controls"

  technical_safeguards:
    164.312_a: "Access Control"
    actions:
      - Unique user identification (required)
      - Emergency access procedure (required)
      - Automatic logoff (addressable)
      - Encryption and decryption (addressable)

    164.312_b: "Audit Controls"
    actions:
      - Implement hardware/software/procedural mechanisms to record and examine access (required)

    164.312_c: "Integrity"
    actions:
      - Mechanism to authenticate ePHI (addressable)

    164.312_d: "Person or Entity Authentication"
    actions:
      - Verify identity of person/entity seeking access (required)

    164.312_e: "Transmission Security"
    actions:
      - Integrity controls (addressable)
      - Encryption (addressable)

privacy_rule:
  minimum_necessary: "Limit PHI use, disclosure, and requests to minimum necessary"
  individual_rights: "Access, amendment, accounting of disclosures, restrictions"
  notice_of_practices: "Provide notice of privacy practices to individuals"

breach_notification_rule:
  individual_notification: "Within 60 days of discovery"
  hhs_notification: "Annual for <500 records; within 60 days for 500+"
  media_notification: "Required when 500+ individuals in a state/jurisdiction"

Lista de Verificação de Implementação de Salvaguardas Técnicas

encryption_requirements:
  at_rest:
    standard: AES-256
    aws_services:
      - [ ] Criptografia do RDS ativada (chave gerenciada pelo KMS)
      - [ ] Criptografia padrão do bucket S3 (SSE-KMS)
      - [ ] Criptografia do volume EBS ativada
      - [ ] Criptografia da tabela DynamoDB (KMS)
      - [ ] Criptografia do ElastiCache em repouso ativada
      - [ ] Criptografia do cluster Redshift ativada
      - [ ] Criptografia do EFS ativada
    azure_services:
      - [ ] Azure SQL TDE ativado (chave gerenciada pelo cliente)
      - [ ] Criptografia da Conta de Armazenamento (CMK)
      - [ ] Criptografia de Disco Gerenciado (SSE com CMK)
      - [ ] Criptografia do Cosmos DB em repouso

    gcp_services:
      - [ ] Criptografia do Cloud SQL (CMEK)
      - [ ] Criptografia do Cloud Storage (CMEK)
      - [ ] Criptografia do BigQuery (CMEK)
      - [ ] Criptografia de Disco Persistente (CMEK)

  in_transit:
    standard: TLS 1.2 ou superior
    checks:
      - [ ] TLS 1.2+ aplicado em todos os balanceadores de carga

…