HIPAA compliance in GitHub CI/CD is not optional if your product handles protected health information (PHI). Code changes, automated builds, deployments — every step must meet the security and audit requirements defined by HIPAA. The controls are concrete: access restriction, audit logging, encryption, and change management. In a CI/CD workflow, those controls have to be built into the pipeline itself, not bolted on afterward.
Start with identity. GitHub must enforce Single Sign-On and MFA. Service accounts need scope-limited tokens — never personal access tokens with broad privileges. Secrets should be stored in GitHub Actions Encrypted Secrets, rotated on schedule, and never embedded in the code. HIPAA requires proof that only authorized staff can trigger or approve deployments. Branch protections, required reviews, and status checks fulfill part of that requirement.
Audit logging is next. GitHub provides repository and organization logs, but HIPAA expects these to be retained and accessible for years. Your CI/CD process should export logs from build runs, deployments, and manual approvals into a secure, centralized system. That system needs immutable storage and quick search capability for incident response.