HIPAA-compliant AWS platforms are not a checklist. They require deliberate PHI boundary definition, Business Associate Agreements, encryption everywhere, and comprehensive audit logging. The minimum viable compliance differs from gold-standard architecture.
PHI Boundary Definition
Identify every data store and compute resource that touches PHI. Draw the boundary explicitly. Everything inside requires BAA, encryption, access controls, and logging. Everything outside can remain standard. Mis-drawn boundaries are the #1 compliance failure.
BAA with AWS
AWS offers a standard BAA for HIPAA-eligible services. Sign it, then restrict workloads to only those services. Use AWS Artifact to download and store the signed agreement. Non-eligible services (some AI services, certain analytics) require separate risk assessment.
Encryption at Rest and in Transit
Enable KMS encryption on all S3, RDS, DynamoDB, and EBS resources. Use customer-managed keys with rotation. Enforce TLS 1.2+ everywhere via security groups and ALB policies. No plaintext PHI exists at rest or in transit.
Access Control
IAM + Cognito for authentication and authorization. Fine-grained access via resource tags and ABAC. Never use root credentials. Implement break-glass procedures with audit trails. MFA required for all human access.
Audit Logging
CloudTrail for API calls, application logs to CloudWatch or S3 with 7-year retention, VPC flow logs, and RDS audit logs. Centralize in a dedicated audit account. Enable GuardDuty and Security Hub for threat detection.
AWS HIPAA-Eligible Services
Core services (EC2, S3, RDS, Lambda, API Gateway, Cognito, KMS, CloudTrail) are eligible. Newer AI services require case-by-case review. Maintain an approved services list and block everything else via SCPs.
Minimum Viable vs Gold Standard
MVP: signed BAA, encryption everywhere, basic access controls, CloudTrail + app logs. Gold standard: customer-managed keys, separate audit account, automated compliance scanning, annual penetration testing, and documented incident response playbooks.
Internal links: see aws cloud infrastructure consultant and aws well architected review guide.
FAQ
How long does HIPAA compliance take on AWS?
8-12 weeks for a focused platform with clear PHI boundaries. Add time for BAA negotiation, policy documentation, and penetration testing.
Can we use AI services with PHI?
Some (Comprehend Medical, HealthLake) are eligible. Others require de-identification or separate non-PHI processing. Check the latest eligibility list.
What if we already have workloads outside the boundary?
Migrate PHI workloads to eligible services or isolate them. Retrofitting is more expensive than building correctly from the start.
How do we prove compliance during an audit?
Maintain the signed BAA, encryption evidence, access logs, and incident response records. AWS Artifact provides the compliance artifacts.
Is "HIPAA compliant" a certification?
No. It is an attestation based on controls. Your architecture and documentation must demonstrate the controls. There is no official AWS HIPAA certification.
Have a project that needs this? Talk to Rutagon or call 907-841-8407.
Related: productionize AI prototype to production, multi agent AI workflow automation.