Skip to main content
Last updated on

Enable HIPAA compliance

This page describes how to enable HIPAA compliance for Lakebase projects. HIPAA compliance applies to workspaces that use the compliance security profile with the HIPAA standard, and it enforces extended audit logging for your databases.

Prerequisites​

  • Lakebase projects running Postgres 16, 17, or 18.
  • An active Business Associate Agreement (BAA) with Databricks before you process protected health information (PHI). See HIPAA.

Enable HIPAA for a workspace​

You enable HIPAA at the workspace level. Lakebase then enforces HIPAA controls, including extended audit logging, for projects in that workspace. You do not take a separate action in the Lakebase UI, API, or CLI to turn on HIPAA audit logging.

  1. Enable the compliance security profile with the HIPAA compliance standard on the workspace. See Enable HIPAA compliance controls.
  2. Wait at least 10 minutes. The setting typically takes up to 10 minutes to reach Lakebase.
  3. Restart the computes of projects that were running when you enabled HIPAA, and of projects that you created during the 10-minute window. See Restart existing projects.

Restart existing projects​

If you enable HIPAA on a workspace that already has running Lakebase projects, those projects must restart before they enforce HIPAA audit logging. Databricks does not automatically restart running instances for you.

To apply HIPAA audit logging to an existing project, restart its compute. Until the compute restarts, the project continues to run without the HIPAA audit configuration.

note

After you enable HIPAA on a workspace, the setting typically takes up to 10 minutes to reach Lakebase. Wait at least 10 minutes before you restart existing computes. A restart during that window might not pick up the HIPAA audit configuration.

Projects that you create after the setting reaches Lakebase enforce HIPAA audit logging from the start. If you create a project during the 10-minute window, restart its compute after the window passes.

Verify audit logging​

To confirm that a compute enforces HIPAA audit logging, connect to it and run:

PostgreSQL
SHOW pgaudit.log;

A compute that enforces HIPAA audit logging returns all, -misc. If it returns none, the compute hasn't picked up the HIPAA audit configuration. Restart it. See Restart existing projects.

To confirm that audit events are being delivered, see Query audit logs.

Next steps​

On this page