Class HipaaRules

java.lang.Object

com.cloudforgeci.api.core.rules.HipaaRules

All Implemented Interfaces:

FrameworkRules<SystemContext>

@ComplianceFramework(value="HIPAA",
                     priority=10,
                     displayName="HIPAA Security Rule",
                     description="Validates HIPAA Security Rule requirements for PHI protection")
public class HipaaRules
extends Object
implements FrameworkRules<SystemContext>

HIPAA Security Rule compliance validation. Validates HIPAA Security Rule requirements (45 CFR Part 160 and Part 164, Subparts A and C). HIPAA Security Rule Coverage: - §164.308(a)(1): Security Management Process - §164.308(a)(3): Workforce Security - §164.308(a)(4): Information Access Management - §164.312(a)(1): Access Control - §164.312(a)(2)(iv): Encryption and Decryption - §164.312(b): Audit Controls - §164.312(c)(1): Integrity - §164.312(d): Person or Entity Authentication - §164.312(e)(1): Transmission Security - §164.316(b)(1): Policies and Procedures - §164.316(b)(2)(i): Retention Note: HIPAA distinguishes between "Required" and "Addressable" specifications. This validator enforces both for maximum protection of PHI (Protected Health Information).

Since:

3.0.0

Constructor Summary

Constructors

Constructor	Description
HipaaRules()

Method Summary

Modifier and Type	Method	Description
Set<String>	claimedControls()	Controls checked across every validate* method above (not just validateMatrixControls(SecurityProfileConfiguration, SecurityProfile, RuntimeType, boolean, Integer, boolean)) -- see FrameworkRules.claimedControls().
String	generateComplianceReport(SystemContext ctx)	Generate HIPAA Security Rule compliance report.
void	install(SystemContext ctx)	Install HIPAA compliance validation rules for production and staging environments.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface FrameworkRules

alwaysLoad, description, displayName, frameworkId, getRequiredConfiguration, priority

Constructor Details

HipaaRules

public HipaaRules()

Method Details

install

public void install(SystemContext ctx)

Install HIPAA compliance validation rules for production and staging environments. HIPAA applies to any environment that processes PHI.

Specified by:

install in interface FrameworkRules<SystemContext>

Parameters:

ctx - the system context containing deployment configuration and CDK stack

claimedControls

public Set<String> claimedControls()

Controls checked across every validate* method above (not just validateMatrixControls(SecurityProfileConfiguration, SecurityProfile, RuntimeType, boolean, Integer, boolean)) -- see FrameworkRules.claimedControls(). Controls the matrix marks REQUIRED for HIPAA but left off this list (KMS_KEY_ROTATION, SECRETS_MANAGER, SECRETS_ROTATION, DATABASE_PITR, CLOUDTRAIL_INSIGHTS, ROOT_ACCOUNT_PROTECTION, CREDENTIAL_ROTATION, DATABASE_ACCESS_CONTROL, CONTAINER_SECURITY, API_SECURITY, LAMBDA_SECURITY, DATABASE_LOGGING, SNS_KMS_ENCRYPTION, SENSITIVE_DATA_DISCOVERY, VULNERABILITY_MANAGEMENT) are intentionally owned by the always-load cross-framework classes instead (KeyManagementRules, DatabaseSecurityRules, IamSecurityRules, and similar) -- a sync check needs the union of every installed framework's claims, not just this one's, to see the full picture.

Specified by:

claimedControls in interface FrameworkRules<SystemContext>

Returns:

the control identifiers this framework's install() validates; empty if undeclared

generateComplianceReport

public String generateComplianceReport(SystemContext ctx)

Generate HIPAA Security Rule compliance report.