Prowler has HIPAA checks. What checklist-based compliance still misses.

✓ Human-authored analysis; AI used for formatting and proofreading.

The 2018 conversation

In Prowler issue #227, a user asked: "any plan to add [HIPAA checks]?"

A contributor laid out a checklist consisting of MFA, VPC flow logs, encrypted EBS volumes, S3 bucket policies, encrypted RDS. The maintainer's response:

"Adding HIPAA checks is no small task and I don't believe checks for full compliance will be possible as it depends much upon how each user/application handles PHI."

They shipped the checks and have continued expanding them. Prowler's release v5.22.0, March 2026 includes HIPAA compliance frameworks for AWS and Azure, listed as a supported framework in the README. The issue was closed in 2018, and HIPAA has been part of Prowler for years.

MFA enabled? Check. Encrypted volumes? Check. Access logs? Check. These are useful checks. They're the same class of checks AWS Config provides. They're necessary but not sufficient.

What the checklist misses

The Prowler HIPAA checks (and AWS Config Conformance Pack, and Security Hub) all share the same architecture: individual rules evaluated independently against individual resources. This creates three blind spots that no checklist can fill.

1. No compound risk

Prowler checks if a bucket is public. Prowler checks if a policy has wildcard actions. But it can't detect that the combination is the S3+IAM lateral movement pattern behind most documented AWS breaches.

Stave detects compound patterns across services:

[high] ec2_to_s3_lateral
Overbroad EC2 instance profile + unrestricted egress = S3 data exfiltration.
(CTL.EC2.PROFILE.OVERBROAD.001 + CTL.VPC.SG.EGRESS.001)

[critical] public_phi_exposure
Public S3 bucket + no encryption enforcement = PHI exposure.
(CTL.S3.PUBLIC.005 + CTL.S3.ENCRYPT.KMS.OWNERSHIP.001)

[high] vpc_endpoint_bypass
VPC endpoint with default policy = any principal on the VPC reaches any S3 bucket.
(CTL.VPC.ENDPOINT.GATEWAY.DEFAULTPOLICY.001)

No individual check catches these. They require cross-rule reasoning.

2. No duration tracking

Prowler tells you a resource is non-compliant right now. It doesn't tell you it's been non-compliant for 6 months.

Finding: phi-patient-records
  First unsafe: 2025-06-01T00:00:00Z
  Last seen:    2026-01-11T00:00:00Z
  Duration:     5,400+ hours (threshold: 168 hours)

For HIPAA, this distinction matters. A bucket that was briefly public during a deploy and caught within the SLA is different from one that's been exposed for 7 months. Duration is the missing dimension in every cloud security checklist.

3. No PHI-specific depth

The Prowler contributor's checklist is service-level: encrypted volumes, access logs, VPC flow logs. These are correct for general AWS hardening. But HIPAA S3 requires deeper analysis:

The Prowler maintainer was right: full HIPAA compliance depends on how each user handles PHI. But that's an argument for a tool that evaluates the actual PHI storage configuration, not just generic service settings.

What the user in #227 needed

The user asking for HIPAA checks in 2018 needed:

1. A HIPAA profile — a curated set of controls mapped to Security Rule sections, not a generic checklist
2. Compound risk detection — dangerous combinations, not just individual failures
3. Duration tracking — how long has this been non-compliant?
4. PHI-specific controls — CMK enforcement, Object Lock compliance mode, presigned URL restrictions
5. Acknowledged exceptions — documented risk acceptance with compensating controls
6. Offline evaluation — auditor-ready evidence, not dashboard access

Prowler shipped item 1 (a checklist with HIPAA framework tags). Items 2-6 remain unaddressed.

How Stave fills the gap

stave apply --observations phi-observations/ --format text

═══ HIPAA Security Rule ═══
Bucket:    phi-patient-records
Result:    FAIL

── COMPOUND RISKS ──

  [critical] public_phi_exposure (triggers: CTL.S3.PUBLIC.005, CTL.S3.ENCRYPT.KMS.OWNERSHIP.001)
  Public bucket with no CMK encryption = PHI exposure

── critical ──

  [FAIL] CTL.S3.ACCESS.001 — critical
  Compliance: §164.312(a)(1) — Access control

  [FAIL] CTL.S3.ENCRYPT.KMS.OWNERSHIP.001 — critical
  Compliance: §164.312(a)(2)(iv) — CMK required for key revocation

── Summary ──

  critical: 0/4 passed
  high:     2/8 passed
  medium:   0/2 passed

3,500+ controls + 770+ chain detectors. Every finding cites the HIPAA section. Duration tracked. Exceptions require compensating controls. Runs offline.

The answer to #227

The Prowler maintainer said full HIPAA compliance checks aren't possible because it depends on how each user handles PHI. It's true that no tool can verify organizational policies, BAAs, or workforce training.

But technical controls on PHI storage infrastructure are verifiable. A bucket either has CMK encryption or it doesn't. Object Lock is either in compliance mode or it isn't. The VPC endpoint either has a restrictive policy or it doesn't.

Stave evaluates what's verifiable and says so explicitly:

"Stave evaluates technical controls only. A BAA with AWS is a contractual prerequisite for HIPAA compliance that Stave cannot verify."

That disclaimer present in every HIPAA report is the honest boundary. Everything inside that boundary, Stave proves. Everything outside it, Stave acknowledges it can't.

That's the answer issue #227 needed in 2018.

Coverage: the full Prowler HIPAA checklist

Against the Prowler HIPAA checklist, every item is covered plus depth beyond the checklist:

What Stave does that no checklist can

Beyond checklist parity, Stave provides capabilities the Prowler architecture has no equivalent for:

• Compound risk detection across services (770+ chain detectors)
• Duration tracking on every finding (SLA-based)
• CMK vs AWS-managed key distinction for PHI encryption
• Object Lock compliance mode tiering for PHI retention
• Presigned URL restrictions for PHI buckets
• Latent exposure detection (public policy behind PAB)
• ACL escalation detection (WRITE_ACP privilege escalation)
• Acknowledged exceptions with mandatory compensating controls
• HIPAA §164.312 citations on every finding
• Proof of pass via logic trace

The checklist covers breadth. Stave covers depth and cross-service reasoning.