Key Takeaways

  • AWS does not certify "HIPAA-compliant" architectures — it offers AWS HIPAA services covered under a signed Business Associate Addendum (BAA); compliance is a shared responsibility you must architect for.
  • Only services listed in AWS's HIPAA Eligible Services Reference can process, store, or transmit Protected Health Information (PHI).
  • Encryption (at rest and in transit), tightly scoped IAM, VPC isolation, and immutable audit logging are the four non-negotiable pillars.
  • A reference architecture using VPC, KMS, CloudTrail, and eligible compute/storage services gets most healthcare workloads to a defensible compliance posture.

What "AWS HIPAA" Actually Means

AWS itself is not HIPAA certified — no cloud platform is, because HIPAA certifies organizational processes, not infrastructure. What AWS offers are HIPAA eligible services: specific services (EC2, S3, RDS, Lambda, DynamoDB, and others) that AWS covers under its standard Business Associate Addendum (BAA), which you must accept via AWS Artifact before processing PHI.

This creates a shared responsibility split:

  • AWS is responsible for: physical security, hypervisor isolation, infrastructure patching for managed services.
  • You are responsible for: which services you use, how you configure encryption and access, your application-layer security, and your audit trail.

Using a non-eligible service (certain preview features, some analytics services) to touch PHI breaks compliance even if AWS has signed your BAA — the BAA only covers the services on that list.

The Four Pillars of HIPAA Aws Services Architecture

1. Encryption Everywhere

PHI must be encrypted at rest and in transit. Use AWS KMS customer-managed keys (CMKs) rather than AWS-managed keys when you need key rotation control and detailed CloudTrail key-usage logs.

# Create a customer-managed KMS key dedicated to PHI workloads
aws kms create-key \
  --description "PHI data encryption key" \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS \
  --tags TagKey=DataClass,TagValue=PHI

# Enforce encryption on an S3 bucket storing PHI documents
aws s3api put-bucket-encryption \
  --bucket phi-records-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
      },
      "BucketKeyEnabled": true
    }]
  }'

In transit, terminate TLS 1.2+ at the load balancer and enforce it end-to-end, including internal service-to-service calls.

2. Least-Privilege IAM

PHI access must be scoped per role, not per environment. A clinician-facing Lambda function should never hold S3 * permissions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::phi-records-bucket/patient-data/*",
      "Condition": {
        "StringEquals": { "s3:x-amz-server-side-encryption": "aws:kms" }
      }
    }
  ]
}

The Condition block above is important: it rejects any write that doesn't use KMS encryption, closing a common misconfiguration gap.

3. Network Isolation

PHI-handling workloads belong in private subnets with no direct internet route. Use VPC endpoints for AWS service traffic (S3, DynamoDB, KMS) so PHI never traverses the public internet, even to reach an AWS API.

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc12345 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0def67890 \
  --vpc-endpoint-type Gateway

4. Immutable, Centralized Audit Logging

HIPAA's audit control requirement (§164.312(b)) demands you can reconstruct who accessed what PHI, when. CloudTrail with log file validation, delivered to a separate log-archive account, satisfies this.

Reference Architecture

<svg viewBox="0 0 760 360" xmlns="http://www.w3.org/2000/svg" style="width:100%;max-width:760px;font-family:sans-serif;color:currentColor">
  <style>
    .box { fill: none; stroke: currentColor; stroke-width: 1.5; }
    .lbl { fill: currentColor; font-size: 13px; }
    .sub { fill: currentColor; font-size: 11px; opacity: 0.7; }
    .arrow { stroke: currentColor; stroke-width: 1.5; marker-end: url(#a2); fill: none; }
  </style>
  <defs>
    <marker id="a2" markerWidth="8" markerHeight="8" refX="6" refY="3" orient="auto">
      <path d="M0,0 L6,3 L0,6 Z" fill="currentColor" />
    </marker>
  </defs>

  <rect class="box" x="300" y="15" width="160" height="45" rx="6" />
  <text class="lbl" x="315" y="42">ALB (TLS 1.2+)</text>

  <rect class="box" x="60" y="100" width="640" height="160" rx="8" />
  <text class="sub" x="75" y="120">Private VPC Subnets — no public route</text>

  <rect class="box" x="90" y="140" width="160" height="60" rx="6" />
  <text class="lbl" x="105" y="165">App Servers</text>
  <text class="sub" x="105" y="183">EC2 / ECS / Lambda</text>

  <rect class="box" x="300" y="140" width="160" height="60" rx="6" />
  <text class="lbl" x="315" y="165">Encrypted RDS</text>
  <text class="sub" x="315" y="183">KMS CMK, at-rest</text>

  <rect class="box" x="510" y="140" width="160" height="60" rx="6" />
  <text class="lbl" x="525" y="165">S3 via VPC Endpoint</text>
  <text class="sub" x="525" y="183">KMS-enforced writes</text>

  <rect class="box" x="90" y="300" width="580" height="45" rx="6" />
  <text class="lbl" x="105" y="327">CloudTrail → Log-Archive Account (immutable, validated)</text>

  <path class="arrow" d="M380,60 V100" />
  <path class="arrow" d="M170,200 V270 H380 V300" style="display:none" />
  <path class="arrow" d="M170,260 V300" />
  <path class="arrow" d="M380,260 V300" />
  <path class="arrow" d="M590,260 V300" />
</svg>

Common Mistakes That Break HIPAA Compliance on AWS

  • Signing the BAA but still routing PHI through non-eligible services (e.g., certain AI/ML preview endpoints).
  • Using AWS-managed KMS keys when audit requirements call for customer-managed key policies and rotation logs.
  • Leaving default VPC security groups open to 0.0.0.0/0 on database ports.
  • Logging PHI values themselves into CloudWatch Logs or application logs — log identifiers, not content.

FAQ

Is AWS automatically HIPAA compliant once I sign the BAA? No. The BAA makes AWS a covered business associate for eligible services, but your architecture, configuration, and operational practices determine actual compliance.

Which AWS services can store PHI? Only services on AWS's HIPAA Eligible Services Reference list — this includes EC2, S3, RDS, DynamoDB, Lambda, and others, but not every AWS service. Always check the current list before architecture decisions.

Do I need a dedicated AWS account for HIPAA workloads? It's strongly recommended. Isolating PHI workloads in a dedicated account with its own guardrails simplifies audit scope and reduces blast radius if a non-PHI workload is compromised.

How long should HIPAA audit logs be retained? HIPAA requires six years of retention for most compliance documentation; many organizations apply the same retention to CloudTrail logs for consistency, stored in an S3 bucket with Object Lock.

Build Your HIPAA-Ready AWS Architecture

Designing AWS hipaa services architecture correctly the first time avoids costly rework and audit findings later. Talk to f9infotech's AWS compliance architects about a reference build tailored to your PHI workloads.