HIPAA Compliance - Wazuh Dashboard Plugins

Overview

The Health Insurance Portability and Accountability Act (HIPAA) establishes national standards for protecting sensitive patient health information. The HIPAA Security Rule specifically requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic Protected Health Information (ePHI). Wazuh helps organizations monitor and maintain HIPAA compliance through security event detection and technical safeguard monitoring.

HIPAA Requirements Coverage

Wazuh maps security events to HIPAA Security Rule requirements through the rule.hipaa field. The compliance requirements are defined in: Source: plugins/main/common/compliance-requirements/hipaa-requirements.ts All monitored requirements are from 45 CFR § 164.312 - Technical Safeguards.

Technical Safeguards Requirements

Access Control (§ 164.312(a))

164.312.a.1 - Access Control Standards

Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights.Technical Measures:

User authentication systems
Authorization controls
Access control lists (ACLs)
Role-based access control (RBAC)
Least privilege enforcement

Monitored by:

Unauthorized access attempts
Access control violations
Authentication failures
Authorization bypasses
Privilege escalation attempts

Wazuh Detection: Failed login attempts, unauthorized file access, permission changes, privilege abuse

164.312.a.2.I - Unique User Identification (Required)

Assign a unique name and/or number for identifying and tracking user identity.Technical Measures:

Unique user IDs for all users
No shared accounts
User identification in all logs
Account lifecycle management

Monitored by:

User account creation/deletion
Shared account usage detection
Non-unique identifier alerts
Account naming violations

Wazuh Detection: Account creation events, shared credential usage, identity tracking violations

164.312.a.2.II - Emergency Access Procedure (Required)

Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.Technical Measures:

Break-glass access procedures
Emergency access accounts
Emergency access logging
Post-emergency access review

Monitored by:

Emergency account usage
Break-glass procedure activation
Out-of-hours ePHI access
Emergency access pattern analysis

Wazuh Detection: Emergency account logins, unusual access times, break-glass activations

164.312.a.2.III - Automatic Logoff (Addressable)

Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.Technical Measures:

Session timeout configuration
Idle session termination
Automatic logout enforcement
Session management controls

Monitored by:

Session timeout violations
Inactive session detection
Session management failures
Long-running session alerts

Wazuh Detection: Session timeout events, idle session warnings, session termination logs

164.312.a.2.IV - Encryption and Decryption (Addressable)

Implement a mechanism to encrypt and decrypt electronic protected health information.Technical Measures:

ePHI encryption at rest
ePHI encryption in transit
Cryptographic key management
Encryption strength requirements

Monitored by:

Unencrypted ePHI access
Weak encryption usage
Encryption failures
Key management violations

Wazuh Detection: Unencrypted data access, weak cipher usage, encryption service failures

Audit Controls (§ 164.312(b))

164.312.b - Audit Controls (Required)

Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.Technical Measures:

Comprehensive logging systems
Audit trail generation
Log analysis and review
Security Information and Event Management (SIEM)
Activity monitoring

Monitored by:

All ePHI access events
System activity logs
User actions on ePHI systems
Security event logs
Administrative actions

Wazuh Detection: All security events related to ePHI systems, providing comprehensive audit trail

This requirement is the foundation for HIPAA compliance monitoring. Wazuh provides the audit control mechanism required by this section.

Integrity Controls (§ 164.312(c))

164.312.c.1 - Integrity (Required)

Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.Technical Measures:

Data integrity verification
Version control systems
Change tracking
Backup and recovery procedures
Write protection mechanisms

Monitored by:

Unauthorized data modifications
Data deletion events
Integrity violation alerts
Improper change attempts

Wazuh Detection: File modification alerts, unauthorized changes, data integrity violations

164.312.c.2 - Mechanism to Authenticate ePHI (Addressable)

Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.Technical Measures:

File integrity monitoring (FIM)
Digital signatures
Checksums and hash verification
Audit logs for data changes
Integrity validation systems

Monitored by:

File integrity violations
Checksum mismatches
Unauthorized file modifications
Digital signature failures

Wazuh Detection: FIM alerts for ePHI file changes, integrity check failures, unauthorized modifications

Enable Wazuh File Integrity Monitoring (FIM) on all directories containing ePHI to meet this requirement.

Person or Entity Authentication (§ 164.312(d))

164.312.d - Authentication (Required)

Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.Technical Measures:

Multi-factor authentication (MFA)
Password policies
Biometric authentication
Certificate-based authentication
Single sign-on (SSO) with strong authentication

Monitored by:

Authentication attempts
Failed authentication events
MFA bypass attempts
Weak authentication usage
Authentication mechanism failures

Wazuh Detection: Failed logins, authentication errors, MFA failures, suspicious authentication patterns

Transmission Security (§ 164.312(e))

164.312.e.1 - Transmission Security (Required)

Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.Technical Measures:

TLS/SSL for data in transit
VPN for remote access
Secure protocols (HTTPS, SFTP, etc.)
Network encryption
Wireless security (WPA3)

Monitored by:

Unencrypted transmissions
Insecure protocol usage
Network security violations
Unauthorized network access
Man-in-the-middle attempts

Wazuh Detection: Unencrypted connections, insecure protocol usage, network intrusion attempts

164.312.e.2.I - Integrity Controls (Addressable)

Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.Technical Measures:

Message integrity checks
Data transmission validation
Checksum verification
Digital signatures for transmitted data
Secure messaging protocols

Monitored by:

Transmission integrity failures
Data corruption detection
Message tampering alerts
Integrity check failures

Wazuh Detection: Network integrity violations, corrupted transmission alerts, data tampering attempts

164.312.e.2.II - Encryption (Addressable)

Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.Technical Measures:

End-to-end encryption
Transport layer security
Email encryption
File transfer encryption
Application-level encryption

Monitored by:

Unencrypted ePHI transmissions
Weak encryption protocols
Encryption failures
Policy violations

Wazuh Detection: Unencrypted data transfers, weak cipher usage, encryption service failures

Using the HIPAA Dashboard

Accessing HIPAA Compliance View

Open HIPAA Module

Navigate to the HIPAA section in the Wazuh Dashboard overview.

Review Technical Safeguards

The dashboard displays all 164.312 technical safeguard requirements.

Filter by Requirement Type

Click on requirement categories: Access Control (a), Audit Controls (b), Integrity (c), Authentication (d), or Transmission Security (e).

Analyze ePHI Security Events

Review security events mapped to each technical safeguard requirement.

Dashboard Components

The HIPAA dashboard includes:

Top requirements by alert count - Identifies technical safeguard violations
Access control monitoring - Tracks § 164.312(a) compliance
Audit trail coverage - Monitors § 164.312(b) implementation
Integrity violations - Shows § 164.312(c) events
Authentication failures - Displays § 164.312(d) issues
Transmission security - Monitors § 164.312(e) compliance

Source: plugins/main/public/components/overview/hipaa/dashboards/dashboard-panels.ts

Data Source Implementation

The HIPAA data source filters events by the rule.hipaa field:

const KEY_EXIST = 'rule.hipaa';

Reference: plugins/main/public/components/common/data-source/pattern/events/hipaa/hipaa-data-source.ts:5

Event Columns

HIPAA events table displays:

Timestamp
Rule description
HIPAA requirement (rule.hipaa field)
Alert level
ePHI system identifier
Agent information

Source: plugins/main/public/components/overview/hipaa/events/hipaa-columns.tsx:8

Compliance Reporting for HIPAA

HIPAA Requirement Naming Convention

HIPAA requirements follow the pattern 164.312.[section].[subsection].[element]:

164.312.a.1 - Technical safeguards, Access Control, standard
164.312.a.2.I - Access Control, implementation specification I (required)
164.312.c.2 - Integrity Controls, addressable implementation specification

Generating HIPAA Reports

Define Audit Period

Select the date range for the HIPAA compliance audit.

Filter by ePHI Systems

Focus on agents and systems that process ePHI.

Document Technical Safeguards

Export evidence of technical safeguard implementation per § 164.312.

Include Audit Controls

Demonstrate audit control implementation (§ 164.312(b)) through log exports.

Generate Compliance Evidence

Create reports showing compliance with required and addressable specifications.

Required vs. Addressable Specifications

Required Specifications
Addressable Specifications

Must be implemented by all covered entities:

164.312.a.1 - Access Control (standard)
164.312.a.2.I - Unique User Identification
164.312.a.2.II - Emergency Access Procedure
164.312.b - Audit Controls
164.312.c.1 - Integrity
164.312.d - Person or Entity Authentication
164.312.e.1 - Transmission Security

Wazuh helps monitor all required specifications.

HIPAA-Specific Use Cases

Audit Controls (§ 164.312(b))

Wazuh serves as the audit control mechanism:

Access Logging

Record all ePHI access events with user identification and timestamps.

Activity Monitoring

Monitor and examine all activity on systems containing ePHI.

Security Event Detection

Detect and alert on security events affecting ePHI systems.

Audit Trail Integrity

Protect audit logs from tampering using file integrity monitoring.

File Integrity Monitoring for ePHI

Meets § 164.312(c.2) - Mechanism to Authenticate ePHI:

<!-- Configure FIM for ePHI directories -->
<syscheck>
  <directories check_all="yes" realtime="yes">/path/to/ephi/data</directories>
  <directories check_all="yes" realtime="yes">/var/www/medical-records</directories>
</syscheck>

Wazuh will alert on any unauthorized modifications to ePHI files.

Access Control Monitoring

Track § 164.312(a) compliance:

Monitor successful and failed authentication attempts
Detect unauthorized access attempts
Track privilege escalation
Identify shared account usage
Monitor emergency access procedures

Transmission Security

Monitor § 164.312(e) compliance:

Detect unencrypted ePHI transmissions
Identify insecure protocol usage (HTTP, FTP, Telnet)
Monitor VPN connections for remote access
Track network intrusion attempts
Verify encryption usage for data in transit

Integration with Other Modules

HIPAA requirements appear in:

MITRE ATT&CK view - Maps ePHI protection to attack techniques
File Integrity Monitoring - Implements § 164.312(c.2)
Vulnerability Detection - Supports risk analysis requirements
NIST 800-53 - Crosswalk between HIPAA and NIST controls

Reference: plugins/main/public/components/overview/mitre/framework/components/techniques/components/rule-details.tsx:120

Requirement Data Structure

The complete HIPAA requirements mapping:

export const hipaaRequirementsFile = {
  '164.312.a.1': 'Implement technical policies and procedures...',
  '164.312.a.2.I': 'Assign a unique name and/or number...',
  '164.312.a.2.II': 'Establish procedures for emergency access...',
  '164.312.a.2.III': 'Implement electronic procedures for session termination...',
  '164.312.a.2.IV': 'Implement a mechanism to encrypt and decrypt...',
  '164.312.b': 'Implement audit controls...',
  '164.312.c.1': 'Implement policies to protect from alteration...',
  '164.312.c.2': 'Implement mechanisms to corroborate integrity...',
  '164.312.d': 'Implement procedures to verify identity...',
  '164.312.e.1': 'Implement technical security measures for transmission...',
  '164.312.e.2.I': 'Implement integrity controls for transmission...',
  '164.312.e.2.II': 'Implement encryption for transmission...',
};

Full definition: plugins/main/common/compliance-requirements/hipaa-requirements.ts:12

Best Practices

Focus on Required Specs

Prioritize monitoring of required implementation specifications.

Enable FIM for ePHI

Use file integrity monitoring on all ePHI storage locations (§ 164.312.c.2).

Monitor Access Controls

Track all access control events to demonstrate § 164.312(a) compliance.

Maintain Audit Trails

Retain audit logs as required by § 164.312(b) and organizational policy.

Regular Security Reviews

Review HIPAA dashboard regularly to identify technical safeguard violations.

Document Addressable Specs

Document implementation or alternatives for addressable specifications.

Risk Analysis Integration

Wazuh data supports HIPAA Security Rule § 164.308(a)(1)(ii)(A) risk analysis:

Threat identification - Security events show active threats to ePHI
Vulnerability assessment - Integration with vulnerability scanning
Impact analysis - Alert severity indicates potential impact
Likelihood determination - Alert frequency shows likelihood of threats

Compliance Overview
[File Integrity Monitoring(/modules/file-integrity-monitoring) - Implements § 164.312(c.2)
[Log Analysis(/modules/threat-hunting) - Implements § 164.312(b)
[Vulnerability Detection(/modules/vulnerability-detection) - Supports risk analysis
[Incident Response(/guides/threat-analysis) - Supports breach notification requirements

Get Started

Core Concepts

Security Modules

Compliance

Cloud Integrations

Agent Management

Configuration

Development

​Overview

​HIPAA Requirements Coverage

​Technical Safeguards Requirements

​Access Control (§ 164.312(a))

​Audit Controls (§ 164.312(b))

​Integrity Controls (§ 164.312(c))

​Person or Entity Authentication (§ 164.312(d))

​Transmission Security (§ 164.312(e))

​Using the HIPAA Dashboard

​Accessing HIPAA Compliance View

​Dashboard Components

​Data Source Implementation

​Event Columns

​Compliance Reporting for HIPAA

​HIPAA Requirement Naming Convention

​Generating HIPAA Reports

​Required vs. Addressable Specifications

​HIPAA-Specific Use Cases

​Audit Controls (§ 164.312(b))

Access Logging

Activity Monitoring

Security Event Detection

Audit Trail Integrity

​File Integrity Monitoring for ePHI

​Access Control Monitoring

​Transmission Security

​Integration with Other Modules

​Requirement Data Structure

​Best Practices

Focus on Required Specs

Enable FIM for ePHI

Monitor Access Controls

Maintain Audit Trails

Regular Security Reviews

Document Addressable Specs

​Risk Analysis Integration

​Related Documentation

Overview

HIPAA Requirements Coverage

Technical Safeguards Requirements

Access Control (§ 164.312(a))

Audit Controls (§ 164.312(b))

Integrity Controls (§ 164.312(c))

Person or Entity Authentication (§ 164.312(d))

Transmission Security (§ 164.312(e))

Using the HIPAA Dashboard

Accessing HIPAA Compliance View

Dashboard Components

Data Source Implementation

Event Columns

Compliance Reporting for HIPAA

HIPAA Requirement Naming Convention

Generating HIPAA Reports

Required vs. Addressable Specifications

HIPAA-Specific Use Cases

Audit Controls (§ 164.312(b))

File Integrity Monitoring for ePHI

Access Control Monitoring

Transmission Security

Integration with Other Modules

Requirement Data Structure

Best Practices

Risk Analysis Integration

Related Documentation