Building HIPAA-Compliant Cloud Architecture on AWS: A Practical Guide

HIPAA compliance on AWS is achievable, but it requires intentional architecture decisions from day one. Retrofitting compliance onto an existing system is expensive and error-prone. Here is the practical guide.

Step 1: Sign a BAA with AWS. AWS offers a Business Associate Agreement that covers a specific set of HIPAA-eligible services. Any service storing or processing PHI must be in scope. Services not covered by the BAA cannot touch PHI — even for logging.

Step 2: Encrypt everything. All PHI must be encrypted at rest and in transit. Use AWS KMS with CMKs (Customer Managed Keys) for RDS, S3, and EBS volumes. TLS 1.2+ is required for all API communication. Enable RDS encryption at creation — you cannot enable it later without a full migration.

Step 3: VPC isolation. All PHI workloads must run in private subnets with no direct internet access. Use NAT gateways for outbound traffic and VPC endpoints for AWS service access (S3, DynamoDB, SQS) to avoid traffic traversing the public internet.

Step 4: Audit logging. CloudTrail must be enabled in all regions and logs must be immutable (S3 Object Lock, WORM mode). CloudWatch Logs with a minimum 6-year retention for audit records. Every access to PHI must be logged with who accessed what and when.

Step 5: Access controls. Implement least-privilege IAM policies. Use AWS Cognito with MFA for all user-facing authentication. Implement break-glass access procedures for emergency access to production systems. Review IAM permissions quarterly.