HIPAA on AWS: What Your Cloud
Architecture Needs to Cover

HIPAA does not prescribe specific technologies. It defines categories of safeguards and requires covered entities and business associates to implement reasonable and appropriate measures within each category. On AWS, this translates to a specific set of services and configuration choices that map directly to each HIPAA requirement.

This article covers the Technical Safeguards section of the HIPAA Security Rule (45 CFR § 164.312) and maps each standard to the AWS services and configurations that address it. It does not cover the Administrative or Physical Safeguard sections, which are largely organizational policy matters rather than cloud architecture decisions.

The HIPAA BAA with AWS

Before any PHI is stored or processed on AWS, you must execute a Business Associate Agreement with AWS. AWS provides a standard BAA that covers a defined set of HIPAA-eligible services. Only services listed in the BAA may be used to store, process, or transmit PHI. The current list includes EC2, RDS, S3, Lambda, ECS, EKS, CloudTrail, CloudWatch, KMS, and many others, but not every AWS service.

Review the AWS HIPAA Eligible Services Reference before architecting any PHI-handling system. Using a non-eligible service to process PHI is a compliance gap regardless of how well you have configured the eligible services around it.

Access Control (§ 164.312(a)(1))

The Access Control standard requires unique user identification, emergency access procedures, automatic logoff, and encryption/decryption.

Unique User Identification

Every person and system accessing PHI must have a unique identity. On AWS, this maps to:

• IAM users or IAM Identity Center (SSO): Each human user gets a unique IAM identity. Use IAM Identity Center for federated access from your corporate directory. Never share IAM user credentials or access keys.
• IAM roles for applications: EC2 instance profiles, Lambda execution roles, and ECS task roles provide unique identities for application components. Use separate roles with minimal permissions per component.
• Service-linked roles: AWS managed roles for service-to-service access. Do not add permissions to service-linked roles.

Minimum Necessary Access

HIPAA requires limiting PHI access to the minimum necessary for each job function. On AWS, enforce this through IAM policies scoped to specific S3 bucket prefixes, specific RDS databases, or specific DynamoDB tables that contain PHI. Avoid wildcard resource ARNs (arn:aws:s3:::*) in policies governing PHI access.

Automatic Logoff

For web applications handling PHI, implement session timeouts at the application layer. For AWS Console access, enforce IAM Identity Center session duration limits. For IAM role sessions, set appropriate MaxSessionDuration values (default is 1 hour for assumed roles).

Audit Controls (§ 164.312(b))

The Audit Controls standard requires hardware, software, and procedural mechanisms to record and examine activity in systems containing PHI.

AWS CloudTrail

CloudTrail must be enabled in all Regions and configured to log to an S3 bucket with:

• S3 Object Lock enabled (WORM compliance: prevents log deletion or modification)
• Server-side encryption with a KMS CMK
• Log file validation enabled (CloudTrail computes a digest file that can verify log integrity)
• SNS notifications for log file delivery (for real-time alerting pipelines)

Enable CloudTrail data events for S3 buckets containing PHI. Management events alone do not capture object-level access (GetObject, PutObject, DeleteObject). Data events are required to satisfy audit logging requirements for PHI stored in S3.

Amazon RDS Audit Logs

For relational databases containing PHI, enable database-level audit logging:

• MySQL/Aurora MySQL: Enable the General Log and Audit Log via RDS parameter groups. Export logs to CloudWatch Logs.
• PostgreSQL/Aurora PostgreSQL: Use the pgaudit extension. Export logs to CloudWatch Logs.
• SQL Server: Enable SQL Server Audit and export to S3.

VPC Flow Logs

Enable VPC Flow Logs on all VPCs containing PHI-handling resources. Flow logs capture network-layer access metadata (source/destination IP, port, protocol, bytes transferred) and are required for network-level audit trails. Publish to CloudWatch Logs or S3 with appropriate retention.

Log Retention

HIPAA requires retaining documentation related to the Security Rule for 6 years. Set CloudWatch Logs retention policies to at least 6 years for logs containing PHI-related audit records. For S3-stored logs, use S3 Lifecycle policies to transition to S3 Glacier after 90 days to reduce storage costs while maintaining retention.

Integrity Controls (§ 164.312(c)(1))

The Integrity standard requires mechanisms to authenticate PHI and protect it from unauthorized alteration or destruction.

• S3 Object Lock: Prevents objects from being deleted or overwritten for a specified retention period. Use for PHI backups and audit logs.
• S3 Versioning: Maintains a history of object versions, allowing recovery from accidental deletion or overwrite. Enable on all S3 buckets containing PHI.
• RDS automated backups and point-in-time recovery: Enable automated backups with a retention period of at least 7 days. PITR provides recovery to any point within the retention window.
• CloudTrail log file validation: Enables cryptographic verification that log files have not been modified since delivery.

Transmission Security (§ 164.312(e)(1))

The Transmission Security standard requires encryption of PHI transmitted over electronic communications networks.

Encryption in Transit

• TLS 1.2 minimum for all external endpoints: Configure ALB and CloudFront to use TLS 1.2 as the minimum protocol version. Use the ELBSecurityPolicy-TLS13-1-2-2021-06 policy on ALBs to enable TLS 1.3 while maintaining 1.2 compatibility.
• Enforce HTTPS: Configure ALB listeners to redirect HTTP to HTTPS. Disable HTTP listeners on production load balancers. Use S3 bucket policies with aws:SecureTransport: false deny statements to block unencrypted S3 API calls.
• RDS SSL/TLS: Require SSL connections to RDS instances by setting the rds.force_ssl parameter to 1 for PostgreSQL and MySQL.
• Internal service communication: Encrypt service-to-service communication within VPCs using TLS where PHI is transmitted. AWS VPC traffic between EC2 instances is not encrypted at the network layer by default.

Encryption at Rest

HIPAA does not explicitly mandate encryption at rest, but it is considered an addressable implementation specification under the Access Control standard, and HHS guidance indicates encryption is the most effective way to satisfy the PHI protection requirements. In practice, any HIPAA-compliant AWS architecture will encrypt all PHI at rest.

Key Management

All encryption for PHI should use AWS KMS Customer Managed Keys (CMKs), not AWS-owned or AWS-managed keys. CMKs provide:

• Full key usage logging in CloudTrail (every encrypt/decrypt operation is logged)
• Key rotation (enable automatic rotation for symmetric CMKs)
• Key policies that restrict which IAM principals can use the key for PHI operations
• Key deletion with a 7-30 day waiting period, preventing accidental immediate deletion

Use separate CMKs for different PHI categories or systems (e.g., one CMK for the patient records database, another for audit log encryption). This limits blast radius if a key policy is misconfigured and provides granular access control.

Network Architecture

PHI-handling systems should be deployed in private subnets with no direct internet access. Traffic flows through:

• An Application Load Balancer in public subnets (TLS termination) forwarding to private subnet targets
• A NAT Gateway for outbound internet access from private subnets (software updates, external API calls)
• VPC endpoints for AWS service access (S3, KMS, SSM, Secrets Manager) to keep traffic off the public internet
• Security groups with minimum necessary ingress/egress rules, documented and reviewed

Enable AWS Config to continuously monitor security group rules, encryption settings, and public access configurations. Set up Config rules for s3-bucket-public-read-prohibited, rds-storage-encrypted, ebs-optimized-instance, and cloud-trail-encryption-enabled at minimum.