bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/security-rule.md

@@ -1,299 +1,299 @@
-# HIPAA Security Rule Reference
-## 45 CFR Part 164, Subparts A and C
-
----
-
-## Table of Contents
-1. [Scope & Applicability](#1-scope--applicability)
-2. [General Rules](#2-general-rules)
-3. [Administrative Safeguards](#3-administrative-safeguards)
-4. [Physical Safeguards](#4-physical-safeguards)
-5. [Technical Safeguards](#5-technical-safeguards)
-6. [Organizational Requirements](#6-organizational-requirements)
-7. [Policies, Procedures & Documentation](#7-policies-procedures--documentation)
-8. [Risk Analysis Deep Dive](#8-risk-analysis-deep-dive)
-9. [Cloud & Modern Architecture Guidance](#9-cloud--modern-architecture-guidance)
-10. [Implementation Checklist](#10-implementation-checklist)
-
----
-
-## 1. Scope & Applicability
-
-The Security Rule applies to **ePHI** (electronic Protected Health Information) — PHI that is:
-- Created, received, maintained, or transmitted in electronic form
-- Stored on any electronic media (servers, workstations, laptops, mobile devices, removable media, cloud)
-
-**Applies to:**
-- Covered Entities (CEs)
-- Business Associates (BAs) — directly under HITECH (2009)
-
-**Does NOT cover:**
-- PHI in paper form (Privacy Rule covers this)
-- Verbal communications
-
----
-
-## 2. General Rules
-
-### Three Safeguard Categories
-All CEs and BAs must implement:
-1. **Administrative Safeguards** — Policies, procedures, workforce management
-2. **Physical Safeguards** — Facility access, workstation, device controls
-3. **Technical Safeguards** — Technology-based protections for ePHI
-
-### Required vs. Addressable
-| Designation | Meaning |
-|------------|---------|
-| **Required** | Must implement — no flexibility |
-| **Addressable** | Must assess whether reasonable and appropriate; if so implement; if not, document why and implement an equivalent alternative |
-
-> **Common Misconception**: "Addressable" does NOT mean optional. You must either implement it or formally document why you didn't and what you did instead.
-
-### Flexibility Principle (§164.306(b))
-Implementation may consider:
-- Size, complexity, and capabilities of the CE/BA
-- Technical infrastructure, hardware, and software security capabilities
-- Costs of security measures
-- Probability and criticality of potential risks
-
----
-
-## 3. Administrative Safeguards
-### §164.308
-
-| Standard | Req/Addr | Description |
-|----------|----------|-------------|
-| **Security Management Process** (§164.308(a)(1)) | Required | Framework for protecting ePHI |
-| → Risk Analysis | Required | Assess threats, vulnerabilities, likelihood, impact |
-| → Risk Management | Required | Implement security measures to reduce risk to reasonable level |
-| → Sanction Policy | Required | Apply sanctions for workforce violations |
-| → Information System Activity Review | Required | Regularly review audit logs, access reports, incident reports |
-| **Assigned Security Responsibility** (§164.308(a)(2)) | Required | Designate a Security Official |
-| **Workforce Security** (§164.308(a)(3)) | Required | Control workforce access to ePHI |
-| → Authorization/Supervision | Addressable | Supervise workforce members working with ePHI |
-| → Workforce Clearance Procedure | Addressable | Determine appropriate access levels |
-| → Termination Procedures | Addressable | Revoke access upon termination |
-| **Information Access Management** (§164.308(a)(4)) | Required | Grant appropriate access to ePHI |
-| → Isolating Healthcare Clearinghouse Function | Required (if applicable) | Separate clearinghouse from rest of org |
-| → Access Authorization | Addressable | Process for authorizing access |
-| → Access Establishment and Modification | Addressable | Process for granting/modifying access |
-| **Security Awareness and Training** (§164.308(a)(5)) | Required | Train all workforce members |
-| → Security Reminders | Addressable | Periodic security updates |
-| → Protection from Malicious Software | Addressable | Anti-malware procedures |
-| → Log-in Monitoring | Addressable | Monitor failed log-in attempts |
-| → Password Management | Addressable | Guidance on creating/changing passwords |
-| **Security Incident Procedures** (§164.308(a)(6)) | Required | Respond to security incidents |
-| → Response and Reporting | Required | Identify, respond to, mitigate, document incidents |
-| **Contingency Plan** (§164.308(a)(7)) | Required | Respond to emergencies affecting ePHI |
-| → Data Backup Plan | Required | Create retrievable exact copies of ePHI |
-| → Disaster Recovery Plan | Required | Restore lost ePHI data |
-| → Emergency Mode Operation Plan | Required | Continue critical business processes during emergency |
-| → Testing and Revision | Addressable | Implement procedures for periodic testing of contingency plans |
-| → Applications and Data Criticality Analysis | Addressable | Assess relative criticality of applications |
-| **Evaluation** (§164.308(a)(8)) | Required | Periodic technical/non-technical evaluation |
-| **Business Associate Contracts** (§164.308(b)(1)) | Required | BAA with all BAs handling ePHI |
-
----
-
-## 4. Physical Safeguards
-### §164.310
-
-| Standard | Req/Addr | Description |
-|----------|----------|-------------|
-| **Facility Access Controls** (§164.310(a)(1)) | Required | Limit physical access to systems containing ePHI |
-| → Contingency Operations | Addressable | Access during disaster recovery |
-| → Facility Security Plan | Addressable | Safeguard facility and equipment |
-| → Access Control and Validation | Addressable | Control access to facilities based on role |
-| → Maintenance Records | Addressable | Document repairs/modifications to physical security |
-| **Workstation Use** (§164.310(b)) | Required | Specify proper functions and physical surroundings for workstations |
-| **Workstation Security** (§164.310(c)) | Required | Physical safeguards for workstations accessing ePHI |
-| **Device and Media Controls** (§164.310(d)(1)) | Required | Govern receipt and removal of hardware/media |
-| → Disposal | Required | Properly dispose of media containing ePHI (wiping, destruction) |
-| → Media Re-use | Required | Remove ePHI before reuse of electronic media |
-| → Accountability | Addressable | Track movements of hardware/media |
-| → Data Backup and Storage | Addressable | Create retrievable copy before moving equipment |
-
----
-
-## 5. Technical Safeguards
-### §164.312
-
-| Standard | Req/Addr | Description |
-|----------|----------|-------------|
-| **Access Control** (§164.312(a)(1)) | Required | Allow only authorized persons/software to access ePHI |
-| → Unique User Identification | Required | Assign unique names/numbers to identify and track user identity |
-| → Emergency Access Procedure | Required | Obtain ePHI during emergency |
-| → Automatic Logoff | Addressable | Terminate sessions after inactivity |
-| → Encryption and Decryption | Addressable | Encrypt/decrypt ePHI |
-| **Audit Controls** (§164.312(b)) | Required | Hardware/software/procedural mechanisms to record and examine activity in systems containing ePHI |
-| **Integrity** (§164.312(c)(1)) | Required | Protect ePHI from improper alteration or destruction |
-| → Mechanism to Authenticate ePHI | Addressable | Corroborate that ePHI has not been altered |
-| **Person or Entity Authentication** (§164.312(d)) | Required | Verify identity of person/entity seeking access |
-| **Transmission Security** (§164.312(e)(1)) | Required | Guard against unauthorized access to ePHI transmitted over electronic networks |
-| → Integrity Controls | Addressable | Ensure ePHI is not improperly modified during transmission |
-| → Encryption | Addressable | Encrypt ePHI in transit |
-
----
-
-## 6. Organizational Requirements
-### §164.314
-
-### Business Associate Contracts (§164.314(a)):
-BAA must require the BA to:
-- Implement Administrative, Physical, and Technical Safeguards
-- Ensure subcontractors do the same (sign sub-BAAs)
-- Report security incidents (including successful and unsuccessful attempts)
-- Authorize termination of contract if CE determines BA has violated a material term
-
-### Group Health Plans (§164.314(b)):
-Plan documents must require plan sponsors to:
-- Implement reasonable and appropriate security measures
-- Not use/disclose ePHI except as permitted
-- Report security incidents to the plan
-
----
-
-## 7. Policies, Procedures & Documentation
-### §164.316
-
-### Policies and Procedures (§164.316(a)):
-- Must implement reasonable and appropriate policies to comply with the Security Rule
-- Must update as necessary
-
-### Documentation Requirements (§164.316(b)):
-- Maintain written (electronic or paper) policies, procedures, and records required by the Security Rule
-- **Retention**: 6 years from creation date OR date last in effect (whichever is later)
-- Make documentation available to those responsible for implementing procedures
-- Review documentation periodically and update as needed
-
----
-
-## 8. Risk Analysis Deep Dive
-
-Risk Analysis (§164.308(a)(1)(ii)(A)) is the **foundation** of HIPAA Security compliance. HHS has emphasized it is the most commonly cited deficiency in enforcement actions.
-
-### Required Components:
-1. **Scope**: All ePHI created, received, maintained, or transmitted (not just EHR — includes backups, emails, mobile devices)
-2. **Threat Identification**: Identify potential threats to ePHI (natural, human, environmental)
-3. **Vulnerability Identification**: Identify security vulnerabilities
-4. **Likelihood Assessment**: Assess probability that each threat would exploit each vulnerability
-5. **Impact Assessment**: Assess potential impact of threat occurrence
-6. **Risk Level Determination**: Combine likelihood + impact = risk level (High/Medium/Low)
-7. **Current Controls**: Document existing security measures and their effectiveness
-
-### Risk Management (§164.308(a)(1)(ii)(B)):
-- Implement security measures sufficient to reduce risks to a reasonable and appropriate level
-- Prioritize based on risk level
-- Document all decisions
-
-### Common Risk Analysis Mistakes (HHS Enforcement Findings):
-- Only analyzing the EHR system (missing emails, mobile devices, backups, printers)
-- Performing once and never updating
-- Not documenting the analysis
-- Confusing risk analysis with gap analysis
-- Assigning risk levels without methodology
-
-### NIST Framework Alignment:
-HHS recommends NIST SP 800-30 for risk analysis methodology. NIST SP 800-66 is the HIPAA-specific guidance.
-
----
-
-## 9. Cloud & Modern Architecture Guidance
-
-### Cloud Service Providers (CSPs):
-- CSPs storing ePHI are Business Associates — **BAA is required**
-- AWS, Azure, GCP all offer HIPAA-eligible services under BAA
-- BAA does not transfer compliance responsibility — CE/BA must configure properly
-
-### Key Cloud Considerations:
-
-**Encryption:**
-- At rest: AES-256 minimum (addressable but industry standard)
-- In transit: TLS 1.2+ minimum; TLS 1.3 recommended
-- Key management: Use dedicated KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS)
-- Customer-managed keys preferred for higher sensitivity
-
-**Access Control:**
-- Implement IAM with least-privilege principle
-- Use MFA for all accounts with ePHI access
-- Separate service accounts from human accounts
-- Regularly audit and rotate credentials
-
-**Audit Logging:**
-- Enable CloudTrail (AWS), Activity Log (Azure), Cloud Audit Logs (GCP)
-- Log: API calls, data access, authentication events, configuration changes
-- Immutable log storage (S3 with Object Lock, etc.)
-- Retention: Minimum 6 years for HIPAA records
-- Alert on anomalous access patterns
-
-**Network Security:**
-- VPC/private network for ePHI systems
-- Security groups / network policies: deny-by-default
-- No direct internet exposure of ePHI datastores
-- WAF for any public-facing applications handling ePHI
-
-**Mobile & BYOD:**
-- MDM/EMM solution required if devices access ePHI
-- Remote wipe capability
-- Screen lock enforcement
-- Encrypted storage
-- App-level controls (MAM) if possible
-
-### API & Application Security:
-- Authentication: OAuth 2.0 + OIDC; consider SMART on FHIR for health apps
-- Input validation to prevent injection attacks
-- No ePHI in URLs (appears in logs)
-- No ePHI in error messages
-- Rate limiting on endpoints handling ePHI
-- FHIR APIs: HL7 FHIR R4 with SMART on FHIR is the modern standard
-
-### DevOps / CI-CD:
-- No real PHI in dev/test environments (use synthetic data)
-- Secrets management (never hardcode credentials)
-- SAST/DAST scanning in pipeline
-- Dependency scanning for vulnerabilities
-- Infrastructure as Code security scanning
-
----
-
-## 10. Implementation Checklist
-
-### Administrative
-- [ ] Designate Security Official
-- [ ] Conduct and document Risk Analysis covering ALL ePHI
-- [ ] Implement Risk Management Plan with prioritized remediation
-- [ ] Implement sanction policy for violations
-- [ ] Review system activity regularly (audit logs)
-- [ ] Establish workforce clearance procedures
-- [ ] Implement access authorization process
-- [ ] Conduct annual Security Awareness Training (document it)
-- [ ] Implement anti-malware protection
-- [ ] Monitor failed login attempts
-- [ ] Document and implement Password/Credential Policy
-- [ ] Implement Security Incident Response Plan
-- [ ] Create Data Backup Plan (test it)
-- [ ] Create Disaster Recovery Plan (test it)
-- [ ] Create Emergency Mode Operation Plan
-- [ ] Execute BAAs with all vendors handling ePHI
-- [ ] Conduct periodic Security Rule evaluations
-
-### Physical
-- [ ] Implement facility access controls (badge, keypad, locks)
-- [ ] Create and implement Facility Security Plan
-- [ ] Document workstation use policies
-- [ ] Implement workstation physical security
-- [ ] Implement media disposal procedures (certificates of destruction)
-- [ ] Implement media re-use procedures (secure wiping)
-- [ ] Track hardware/media movements
-
-### Technical
-- [ ] Assign unique user IDs (no shared accounts)
-- [ ] Implement role-based access control (RBAC)
-- [ ] Implement MFA for all ePHI access
-- [ ] Implement automatic session timeout
-- [ ] Implement encryption at rest (AES-256)
-- [ ] Implement encryption in transit (TLS 1.2+)
-- [ ] Enable and monitor audit logs
-- [ ] Implement integrity controls (checksums, digital signatures)
-- [ ] Implement entity authentication mechanisms
-- [ ] Test transmission security controls
+# HIPAA Security Rule Reference
+## 45 CFR Part 164, Subparts A and C
+
+---
+
+## Table of Contents
+1. [Scope & Applicability](#1-scope--applicability)
+2. [General Rules](#2-general-rules)
+3. [Administrative Safeguards](#3-administrative-safeguards)
+4. [Physical Safeguards](#4-physical-safeguards)
+5. [Technical Safeguards](#5-technical-safeguards)
+6. [Organizational Requirements](#6-organizational-requirements)
+7. [Policies, Procedures & Documentation](#7-policies-procedures--documentation)
+8. [Risk Analysis Deep Dive](#8-risk-analysis-deep-dive)
+9. [Cloud & Modern Architecture Guidance](#9-cloud--modern-architecture-guidance)
+10. [Implementation Checklist](#10-implementation-checklist)
+
+---
+
+## 1. Scope & Applicability
+
+The Security Rule applies to **ePHI** (electronic Protected Health Information) — PHI that is:
+- Created, received, maintained, or transmitted in electronic form
+- Stored on any electronic media (servers, workstations, laptops, mobile devices, removable media, cloud)
+
+**Applies to:**
+- Covered Entities (CEs)
+- Business Associates (BAs) — directly under HITECH (2009)
+
+**Does NOT cover:**
+- PHI in paper form (Privacy Rule covers this)
+- Verbal communications
+
+---
+
+## 2. General Rules
+
+### Three Safeguard Categories
+All CEs and BAs must implement:
+1. **Administrative Safeguards** — Policies, procedures, workforce management
+2. **Physical Safeguards** — Facility access, workstation, device controls
+3. **Technical Safeguards** — Technology-based protections for ePHI
+
+### Required vs. Addressable
+| Designation | Meaning |
+|------------|---------|
+| **Required** | Must implement — no flexibility |
+| **Addressable** | Must assess whether reasonable and appropriate; if so implement; if not, document why and implement an equivalent alternative |
+
+> **Common Misconception**: "Addressable" does NOT mean optional. You must either implement it or formally document why you didn't and what you did instead.
+
+### Flexibility Principle (§164.306(b))
+Implementation may consider:
+- Size, complexity, and capabilities of the CE/BA
+- Technical infrastructure, hardware, and software security capabilities
+- Costs of security measures
+- Probability and criticality of potential risks
+
+---
+
+## 3. Administrative Safeguards
+### §164.308
+
+| Standard | Req/Addr | Description |
+|----------|----------|-------------|
+| **Security Management Process** (§164.308(a)(1)) | Required | Framework for protecting ePHI |
+| → Risk Analysis | Required | Assess threats, vulnerabilities, likelihood, impact |
+| → Risk Management | Required | Implement security measures to reduce risk to reasonable level |
+| → Sanction Policy | Required | Apply sanctions for workforce violations |
+| → Information System Activity Review | Required | Regularly review audit logs, access reports, incident reports |
+| **Assigned Security Responsibility** (§164.308(a)(2)) | Required | Designate a Security Official |
+| **Workforce Security** (§164.308(a)(3)) | Required | Control workforce access to ePHI |
+| → Authorization/Supervision | Addressable | Supervise workforce members working with ePHI |
+| → Workforce Clearance Procedure | Addressable | Determine appropriate access levels |
+| → Termination Procedures | Addressable | Revoke access upon termination |
+| **Information Access Management** (§164.308(a)(4)) | Required | Grant appropriate access to ePHI |
+| → Isolating Healthcare Clearinghouse Function | Required (if applicable) | Separate clearinghouse from rest of org |
+| → Access Authorization | Addressable | Process for authorizing access |
+| → Access Establishment and Modification | Addressable | Process for granting/modifying access |
+| **Security Awareness and Training** (§164.308(a)(5)) | Required | Train all workforce members |
+| → Security Reminders | Addressable | Periodic security updates |
+| → Protection from Malicious Software | Addressable | Anti-malware procedures |
+| → Log-in Monitoring | Addressable | Monitor failed log-in attempts |
+| → Password Management | Addressable | Guidance on creating/changing passwords |
+| **Security Incident Procedures** (§164.308(a)(6)) | Required | Respond to security incidents |
+| → Response and Reporting | Required | Identify, respond to, mitigate, document incidents |
+| **Contingency Plan** (§164.308(a)(7)) | Required | Respond to emergencies affecting ePHI |
+| → Data Backup Plan | Required | Create retrievable exact copies of ePHI |
+| → Disaster Recovery Plan | Required | Restore lost ePHI data |
+| → Emergency Mode Operation Plan | Required | Continue critical business processes during emergency |
+| → Testing and Revision | Addressable | Implement procedures for periodic testing of contingency plans |
+| → Applications and Data Criticality Analysis | Addressable | Assess relative criticality of applications |
+| **Evaluation** (§164.308(a)(8)) | Required | Periodic technical/non-technical evaluation |
+| **Business Associate Contracts** (§164.308(b)(1)) | Required | BAA with all BAs handling ePHI |
+
+---
+
+## 4. Physical Safeguards
+### §164.310
+
+| Standard | Req/Addr | Description |
+|----------|----------|-------------|
+| **Facility Access Controls** (§164.310(a)(1)) | Required | Limit physical access to systems containing ePHI |
+| → Contingency Operations | Addressable | Access during disaster recovery |
+| → Facility Security Plan | Addressable | Safeguard facility and equipment |
+| → Access Control and Validation | Addressable | Control access to facilities based on role |
+| → Maintenance Records | Addressable | Document repairs/modifications to physical security |
+| **Workstation Use** (§164.310(b)) | Required | Specify proper functions and physical surroundings for workstations |
+| **Workstation Security** (§164.310(c)) | Required | Physical safeguards for workstations accessing ePHI |
+| **Device and Media Controls** (§164.310(d)(1)) | Required | Govern receipt and removal of hardware/media |
+| → Disposal | Required | Properly dispose of media containing ePHI (wiping, destruction) |
+| → Media Re-use | Required | Remove ePHI before reuse of electronic media |
+| → Accountability | Addressable | Track movements of hardware/media |
+| → Data Backup and Storage | Addressable | Create retrievable copy before moving equipment |
+
+---
+
+## 5. Technical Safeguards
+### §164.312
+
+| Standard | Req/Addr | Description |
+|----------|----------|-------------|
+| **Access Control** (§164.312(a)(1)) | Required | Allow only authorized persons/software to access ePHI |
+| → Unique User Identification | Required | Assign unique names/numbers to identify and track user identity |
+| → Emergency Access Procedure | Required | Obtain ePHI during emergency |
+| → Automatic Logoff | Addressable | Terminate sessions after inactivity |
+| → Encryption and Decryption | Addressable | Encrypt/decrypt ePHI |
+| **Audit Controls** (§164.312(b)) | Required | Hardware/software/procedural mechanisms to record and examine activity in systems containing ePHI |
+| **Integrity** (§164.312(c)(1)) | Required | Protect ePHI from improper alteration or destruction |
+| → Mechanism to Authenticate ePHI | Addressable | Corroborate that ePHI has not been altered |
+| **Person or Entity Authentication** (§164.312(d)) | Required | Verify identity of person/entity seeking access |
+| **Transmission Security** (§164.312(e)(1)) | Required | Guard against unauthorized access to ePHI transmitted over electronic networks |
+| → Integrity Controls | Addressable | Ensure ePHI is not improperly modified during transmission |
+| → Encryption | Addressable | Encrypt ePHI in transit |
+
+---
+
+## 6. Organizational Requirements
+### §164.314
+
+### Business Associate Contracts (§164.314(a)):
+BAA must require the BA to:
+- Implement Administrative, Physical, and Technical Safeguards
+- Ensure subcontractors do the same (sign sub-BAAs)
+- Report security incidents (including successful and unsuccessful attempts)
+- Authorize termination of contract if CE determines BA has violated a material term
+
+### Group Health Plans (§164.314(b)):
+Plan documents must require plan sponsors to:
+- Implement reasonable and appropriate security measures
+- Not use/disclose ePHI except as permitted
+- Report security incidents to the plan
+
+---
+
+## 7. Policies, Procedures & Documentation
+### §164.316
+
+### Policies and Procedures (§164.316(a)):
+- Must implement reasonable and appropriate policies to comply with the Security Rule
+- Must update as necessary
+
+### Documentation Requirements (§164.316(b)):
+- Maintain written (electronic or paper) policies, procedures, and records required by the Security Rule
+- **Retention**: 6 years from creation date OR date last in effect (whichever is later)
+- Make documentation available to those responsible for implementing procedures
+- Review documentation periodically and update as needed
+
+---
+
+## 8. Risk Analysis Deep Dive
+
+Risk Analysis (§164.308(a)(1)(ii)(A)) is the **foundation** of HIPAA Security compliance. HHS has emphasized it is the most commonly cited deficiency in enforcement actions.
+
+### Required Components:
+1. **Scope**: All ePHI created, received, maintained, or transmitted (not just EHR — includes backups, emails, mobile devices)
+2. **Threat Identification**: Identify potential threats to ePHI (natural, human, environmental)
+3. **Vulnerability Identification**: Identify security vulnerabilities
+4. **Likelihood Assessment**: Assess probability that each threat would exploit each vulnerability
+5. **Impact Assessment**: Assess potential impact of threat occurrence
+6. **Risk Level Determination**: Combine likelihood + impact = risk level (High/Medium/Low)
+7. **Current Controls**: Document existing security measures and their effectiveness
+
+### Risk Management (§164.308(a)(1)(ii)(B)):
+- Implement security measures sufficient to reduce risks to a reasonable and appropriate level
+- Prioritize based on risk level
+- Document all decisions
+
+### Common Risk Analysis Mistakes (HHS Enforcement Findings):
+- Only analyzing the EHR system (missing emails, mobile devices, backups, printers)
+- Performing once and never updating
+- Not documenting the analysis
+- Confusing risk analysis with gap analysis
+- Assigning risk levels without methodology
+
+### NIST Framework Alignment:
+HHS recommends NIST SP 800-30 for risk analysis methodology. NIST SP 800-66 is the HIPAA-specific guidance.
+
+---
+
+## 9. Cloud & Modern Architecture Guidance
+
+### Cloud Service Providers (CSPs):
+- CSPs storing ePHI are Business Associates — **BAA is required**
+- AWS, Azure, GCP all offer HIPAA-eligible services under BAA
+- BAA does not transfer compliance responsibility — CE/BA must configure properly
+
+### Key Cloud Considerations:
+
+**Encryption:**
+- At rest: AES-256 minimum (addressable but industry standard)
+- In transit: TLS 1.2+ minimum; TLS 1.3 recommended
+- Key management: Use dedicated KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS)
+- Customer-managed keys preferred for higher sensitivity
+
+**Access Control:**
+- Implement IAM with least-privilege principle
+- Use MFA for all accounts with ePHI access
+- Separate service accounts from human accounts
+- Regularly audit and rotate credentials
+
+**Audit Logging:**
+- Enable CloudTrail (AWS), Activity Log (Azure), Cloud Audit Logs (GCP)
+- Log: API calls, data access, authentication events, configuration changes
+- Immutable log storage (S3 with Object Lock, etc.)
+- Retention: Minimum 6 years for HIPAA records
+- Alert on anomalous access patterns
+
+**Network Security:**
+- VPC/private network for ePHI systems
+- Security groups / network policies: deny-by-default
+- No direct internet exposure of ePHI datastores
+- WAF for any public-facing applications handling ePHI
+
+**Mobile & BYOD:**
+- MDM/EMM solution required if devices access ePHI
+- Remote wipe capability
+- Screen lock enforcement
+- Encrypted storage
+- App-level controls (MAM) if possible
+
+### API & Application Security:
+- Authentication: OAuth 2.0 + OIDC; consider SMART on FHIR for health apps
+- Input validation to prevent injection attacks
+- No ePHI in URLs (appears in logs)
+- No ePHI in error messages
+- Rate limiting on endpoints handling ePHI
+- FHIR APIs: HL7 FHIR R4 with SMART on FHIR is the modern standard
+
+### DevOps / CI-CD:
+- No real PHI in dev/test environments (use synthetic data)
+- Secrets management (never hardcode credentials)
+- SAST/DAST scanning in pipeline
+- Dependency scanning for vulnerabilities
+- Infrastructure as Code security scanning
+
+---
+
+## 10. Implementation Checklist
+
+### Administrative
+- [ ] Designate Security Official
+- [ ] Conduct and document Risk Analysis covering ALL ePHI
+- [ ] Implement Risk Management Plan with prioritized remediation
+- [ ] Implement sanction policy for violations
+- [ ] Review system activity regularly (audit logs)
+- [ ] Establish workforce clearance procedures
+- [ ] Implement access authorization process
+- [ ] Conduct annual Security Awareness Training (document it)
+- [ ] Implement anti-malware protection
+- [ ] Monitor failed login attempts
+- [ ] Document and implement Password/Credential Policy
+- [ ] Implement Security Incident Response Plan
+- [ ] Create Data Backup Plan (test it)
+- [ ] Create Disaster Recovery Plan (test it)
+- [ ] Create Emergency Mode Operation Plan
+- [ ] Execute BAAs with all vendors handling ePHI
+- [ ] Conduct periodic Security Rule evaluations
+
+### Physical
+- [ ] Implement facility access controls (badge, keypad, locks)
+- [ ] Create and implement Facility Security Plan
+- [ ] Document workstation use policies
+- [ ] Implement workstation physical security
+- [ ] Implement media disposal procedures (certificates of destruction)
+- [ ] Implement media re-use procedures (secure wiping)
+- [ ] Track hardware/media movements
+
+### Technical
+- [ ] Assign unique user IDs (no shared accounts)
+- [ ] Implement role-based access control (RBAC)
+- [ ] Implement MFA for all ePHI access
+- [ ] Implement automatic session timeout
+- [ ] Implement encryption at rest (AES-256)
+- [ ] Implement encryption in transit (TLS 1.2+)
+- [ ] Enable and monitor audit logs
+- [ ] Implement integrity controls (checksums, digital signatures)
+- [ ] Implement entity authentication mechanisms
+- [ ] Test transmission security controls