Benchmark: 164.308(a)(3)(ii) Implementation specifications

Description

Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed. Implement procedures to determine that a workforce member's access to electronic protected health information is appropriate. Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.

Usage

Install the mod:

mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-gcp-compliance

Start the Powerpipe server:

steampipe service start
powerpipe server

Open http://localhost:9033 in your browser and select 164.308(a)(3)(ii) Implementation specifications.

Run this benchmark in your terminal:

powerpipe benchmark run gcp_compliance.benchmark.hipaa_164_308_a_3_ii

Snapshot and share results via Turbot Pipes:

powerpipe benchmark run gcp_compliance.benchmark.hipaa_164_308_a_3_ii --share

Controls

• Ensure that Compute instances do not have public IP addresses
• Ensure that IAM users are not assigned the Service Account User or Service Account Token Creator roles at project level
• Ensure that Cloud KMS cryptokeys are not anonymously or publicly accessible
• Ensure that Separation of duties is enforced while assigning KMS related roles to users
• Prevent a public IP from being assigned to a Cloud SQL instance
• Check if BigQuery datasets are publicly readable
• Check if Cloud Storage buckets have Bucket Only Policy turned on
• Ensure 'skip_show_database' database flag for Cloud SQL Mysql instance is set to 'on'
• Ensure Instance IP assignment is set to private
• Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'
• Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'
• Ensure that Cloud Storage buckets used for exporting logs are configured using bucket lock

Tags