HIPAA

This page describes HIPAA compliance controls in Azure Databricks.

HIPAA overview

HIPAA is a US healthcare law that establishes national standards for protecting the privacy and security of protected health information (PHI).

Key points:

• Applies to healthcare providers, insurers, and vendors that handle PHI.
• Includes rules for privacy, security, and breach notification.
• Requires administrative, technical, and physical safeguards for PHI.
• Applies to cloud service providers that store or process PHI.

Enable HIPAA compliance controls

HIPAA compliance controls require enabling the compliance security profile, which adds monitoring agents, provides a hardened compute image, and other features. Only specific preview features are supported for processing regulated data. For details on the compliance security profile and supported preview features, see Compliance security profile.

To enable HIPAA compliance controls, see Configure enhanced security and compliance settings.

Shared responsibility of HIPAA compliance

HIPAA compliance spans three major areas, each with different responsibilities. Although every party has numerous responsibilities, the following sections list the key responsibilities you share with Azure Databricks.

This section use the terminology control plane and compute plane, which are two main parts of Azure Databricks architecture:

• The Azure Databricks control plane includes the backend services that Azure Databricks manages in its own Azure account.
• The compute plane is where your data lake is processed. The classic compute plane includes a VNet in your Azure account, and clusters of compute resources to process your notebooks, jobs, and pro or classic SQL warehouses.

For more information, see High-level architecture.

You are solely responsible for verifying that sensitive information is never entered in customer-defined input fields, such as workspace names, compute resource names, tags, job names, job run names, network names, credential names, storage account names, and Git repository IDs or URLs. These fields might be stored, processed, or accessed outside the compliance boundary.

Key responsibilities of Microsoft include:

• Perform its obligations as a business associate under your BAA with Microsoft.
• Provide you VMs under your contract with Microsoft that support HIPAA compliance.

• Delete encryption keys and data when Azure Databricks releases the VM instances.

Key responsibilities of Azure Databricks include:

• Encrypt in-transit PHI data sent to or from the control plane.
• Encrypt PHI data at rest in the control plane.
• Use only instance types that are supported using the compliance security profile. Azure Databricks enforces this in both the workspace and API.
• Deprovision VM instances when you indicate in Azure Databricks (for example, through auto-termination or manual termination) so Azure can wipe them.

Key responsibilities of yours:

• Enable the compliance security profile on every workspace that processes PHI data.
• Configure your workspace to use either customer-managed keys for managed services or the Store interactive notebook results in customer account feature.
• Do not use preview features in Azure Databricks to process PHI, except those listed in Regional support for features.
• Follow security best practices, such as disabling unnecessary egress from the compute plane and using Azure Databricks secrets to store access keys for PHI.
• Enter into a business associate agreement with Microsoft to cover all data processed within the VNet where VM instances are deployed.
• Do not perform actions within a virtual machine that would violate HIPAA. For example, do not direct Azure Databricks to send unencrypted PHI to an endpoint.
• Verify all data that may contain PHI is encrypted at rest in any storage location the Azure Databricks platform interacts with. This includes setting encryption on workspace storage accounts during workspace creation. You are responsible for encryption and backups of this storage and all other data sources.
• Verify all data that may contain PHI is encrypted in transit between Azure Databricks and any connected data storage or external systems. For example, APIs used in notebooks must use encryption for all outbound connections.

Regional support for features

This table shows feature availability for the selected compliance standard across all supported Databricks regions. Some features may be listed as available before they are actually released.