The cluster was quiet except for the hum of containers. Then the audit alert hit. A HIPAA compliance gap had been found on a live system—inside Kubernetes.
HIPAA technical safeguards are not optional. They are strict requirements for protecting electronic protected health information (ePHI). In Kubernetes, enforcing these safeguards means controlling access, securing data in transit, encrypting secrets at rest, and monitoring every request that touches sensitive workloads.
Kubectl is the knife-edge. It is powerful and dangerous. Every kubectl get, kubectl exec, and kubectl port-forward can expose protected data if access controls fail. Role-Based Access Control (RBAC) is the foundation. Configure Kubernetes Roles and RoleBindings so only authorized service accounts and human users can perform sensitive operations. Use short-lived credentials. Rotate them. Revoke on breach.
Audit logging must be enabled at the API server level. HIPAA requires the ability to record who accessed what data, when, and how. Point these logs to secure, immutable storage. Filter them to track kubectl activity in detail. Every kubectl exec should leave a trail.