Checkov HIPAA Scanning

Purpose

This document describes how Checkov is used to scan Terraform infrastructure-as-code for HIPAA compliance violations as part of the CI/CD pipeline.

Checkov was selected over alternatives (such as tfsec) specifically because of its built-in HIPAA policy library, which maps checks directly to HIPAA technical safeguard requirements. This allows compliance findings to be traced back to specific controls rather than generic security best practices.

Current State

Checkov scanning is active on all pull requests across all three infrastructure repositories. Results are currently informational only — the pipeline does not fail on findings at this time. This is an intentional decision to allow the team to establish a baseline of findings and prioritize remediation before enforcing hard failures.

The roadmap goal is to progress to enforced failures on high-severity findings once the initial remediation backlog is addressed.

Maturity Progression

Phase	Status	Description
Scanning enabled	✅ Complete	Checkov runs on every PR
Baseline established	🔄 In Progress	Reviewing initial findings
High severity enforcement	📅 Planned	Pipeline fails on high severity
Full enforcement	📅 Planned	All violations block merge

How It Works

Pipeline Step

Checkov runs as a GitHub Actions step after terraform validate and before terraform plan. This ensures code is syntactically valid before scanning, and that no non-compliant code proceeds to a plan.

- name: Checkov HIPAA Scan
  uses: bridgecrewio/checkov-action@master
  with:
    directory: .
    framework: terraform
    output_format: cli

What Gets Scanned

Checkov scans all .tf files in the repository for misconfigurations mapped to HIPAA controls. Key areas it checks include:

Access Controls (§164.312(a))

• IAM policies that are overly permissive
• Missing MFA requirements
• Public access to storage accounts or S3 buckets

Audit Controls (§164.312(b))

• Missing diagnostic logging on Azure resources
• CloudTrail not enabled in AWS
• Log retention periods too short

Transmission Security (§164.312(e))

• Unencrypted data in transit
• TLS version requirements
• Insecure network configurations

Encryption (§164.312(a)(2)(iv))

• Storage encryption not enabled
• Database encryption at rest not configured
• Key management misconfigurations

Handling Findings

Reviewing Results

Checkov output appears in the GitHub Actions log for the PR. Each finding includes:

• The check ID (e.g., CKV_AZURE_35)
• The HIPAA control it maps to
• The resource that failed
• The file and line number

Remediation

When a finding is legitimate, fix the Terraform code to address it before merging. Common fixes include enabling encryption flags, adding diagnostic settings, or tightening network security group rules.

Suppressing a Check

When a finding is a known acceptable risk or a false positive, it can be suppressed inline with a justification comment. All suppressions must include a reason.

resource "azurerm_storage_account" "example" {
  # checkov:skip=CKV_AZURE_35:Network ACLs not required - private endpoint only
  name                = "examplestorage"
  ...
}

Suppressions should be reviewed periodically to ensure they remain valid. Any suppressed check should be tracked in the risk register with an accepted risk entry.

Relationship to Other Compliance Tools

Checkov operates at the infrastructure-as-code layer — it catches misconfigurations before they are deployed. It is complementary to, not a replacement for, runtime compliance tools.

Tool	Layer	Purpose
Checkov	IaC (pre-deploy)	Catches misconfigurations in Terraform code
Azure Policy	Runtime (post-deploy)	Detects drift in deployed Azure resources
AWS Security Hub	Runtime (post-deploy)	Detects drift in deployed AWS resources

The goal is defense in depth — Checkov prevents new violations from being introduced, while Azure Policy and AWS Security Hub catch any drift that occurs outside of Terraform.

Document History

Date	Change	Author
February 2026	Initial draft	Rory

Related Documentation

• CI/CD Pipeline Overview
• Azure Infrastructure Overview
• AWS DR Overview