Skip to main content
Last updated on

HIPAA compliance for Lakebase

Lakebase supports workspaces with the compliance security profile so that you can process regulated data, including protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). This page explains what compliance support means for Lakebase, which compliance standards are supported, and how responsibility for PHI is shared. For the platform-wide HIPAA controls and requirements, see HIPAA.

Supported compliance standards​

Lakebase is available for workspaces with the compliance security profile when the compliance standard is set to HIPAA, C5, TISAX, or None.

When a workspace uses the compliance security profile with the HIPAA standard, Lakebase enforces the controls required for HIPAA, including extended audit logging for database activity. For more about how audit events are captured and delivered, see HIPAA audit logging.

note

HIPAA is the only compliance standard that enables extended audit logging for Lakebase. C5 and TISAX are supported at the workspace level but do not apply Lakebase-specific audit behavior.

Shared responsibility for PHI​

Databricks and your organization share responsibility for keeping PHI protected in Lakebase. This section describes the responsibilities specific to Lakebase. For the platform-wide HIPAA shared responsibility model, see Shared responsibility of HIPAA compliance.

What Databricks provides​

Databricks provides the compliant platform that Lakebase runs on, including:

  • Infrastructure that meets HIPAA requirements when the workspace uses the compliance security profile.
  • Encryption of data at rest and in transit.
  • Audit logging for HIPAA-enabled projects, delivered to the audit log system table. See HIPAA audit logging.

Your responsibilities​

Your organization is responsible for how you handle PHI in your Lakebase databases:

  • Keep PHI out of metadata. Do not put PHI in database object names, such as database, schema, table, or column names. These names can appear in audit logs and system metadata.
  • Keep PHI out of query text. Audit logs can record statement text. Avoid embedding PHI as literal values in queries. Use parameterized queries where possible.
  • Keep PHI out of support tickets. Do not include PHI in support requests, screenshots, or diagnostic output that you share with Databricks.
  • Configure access controls. Grant database roles and permissions according to least privilege. See Roles and permissions.
  • Manage audit log retention. Review and retain audit logs according to your compliance obligations. See Audit log retention.
important

Databricks cannot remove PHI that you place in object names or query text after the fact. Preventing PHI from entering these locations is your responsibility.

Business Associate Agreement​

Processing PHI under HIPAA requires a Business Associate Agreement (BAA). How the BAA applies depends on your cloud provider. For details, see HIPAA.

Next steps​

  • Enable HIPAA compliance: Turn on compliance support for your Lakebase projects. See Enable HIPAA compliance.
  • HIPAA audit logging: Understand how Lakebase captures, delivers, and records audit events. See HIPAA audit logging.
On this page