HIPAA Compliance on AWS: What Covered Entities Must Configure

HIPAA and AWS: The Shared Responsibility Model

AWS is a HIPAA-compliant cloud platform, but compliance is not automatic. Under the shared responsibility model, AWS secures the infrastructure while covered entities and business associates must configure services correctly to protect protected health information. A signed Business Associate Agreement is the starting point, not the finish line.

The U.S. Department of Health and Human Services expects covered entities to apply administrative, physical, and technical safeguards regardless of where data lives. AWS provides the tools; the organization owns the configuration, access decisions, and ongoing monitoring.

HIPAA-Eligible AWS Services

Not every AWS service is HIPAA-eligible. AWS maintains a growing list of services that can be used in a HIPAA-compliant workload when a BAA is in place. Core services commonly used for healthcare workloads include:

• Amazon EC2 for compute
• Amazon S3 for object storage
• Amazon RDS and Amazon DynamoDB for databases
• AWS Lambda for serverless functions
• Amazon CloudWatch for logging and monitoring
• AWS Key Management Service for encryption key control
• Amazon Cognito for identity and access management
• AWS CloudTrail for API activity auditing
• Amazon VPC for network isolation

Using a service outside the eligible list, or using an eligible service in a non-compliant region, breaks the compliance posture. Region selection matters because not all AWS regions support BAA-covered operations.

Business Associate Agreements and AWS

AWS will enter into a BAA for covered entities and their business associates. The BAA binds AWS to the HIPAA Security Rule obligations for the services covered. Organizations must sign the AWS Business Associate Addendum before they process PHI in AWS.

Key obligations the BAA covers include:

• Permitted uses and disclosures of PHI
• Requirements to report breaches or unauthorized access
• Subcontractor or downstream processor restrictions
• Data return or destruction at termination

A BAA does not replace the organization's own compliance work. It shifts some accountability to AWS but leaves the covered entity responsible for the configuration and governance of its workload.

Configuring Access Controls

Technical safeguards under HIPAA start with access control. AWS IAM is the primary mechanism for enforcing least privilege.

• Create individual IAM users instead of sharing credentials
• Attach granular policies following the principle of least privilege
• Require multi-factor authentication for all human users
• Use IAM roles for applications and services rather than long-lived access keys
• Enable AWS Organizations Service Control Policies to restrict actions across accounts
• Integrate with identity providers for centralized access management

Access reviews should be periodic. Stale permissions, unused roles, and over-privileged service accounts are common misconfigurations that create PHI exposure.

Encryption and Key Management

HIPAA does not prescribe a specific algorithm, but it does require encryption at rest and in transit for PHI. AWS provides options at multiple layers.

• Amazon S3 server-side encryption with AWS KMS keys
• Amazon EBS volume encryption
• TLS 1.2 or later for data in transit
• Application-layer encryption before data enters AWS

Using AWS KMS gives organizations control over key rotation, access policies, and audit trails. The organization remains responsible for key lifecycle decisions, including when to rotate or revoke keys.

Logging, Monitoring, and Auditing

Auditable evidence is essential for demonstrating compliance. AWS CloudTrail captures API calls across services, while Amazon CloudWatch provides operational visibility.

Effective logging for a HIPAA workload includes:

• Enabling CloudTrail in all regions with log file validation
• Sending logs to a dedicated, locked S3 bucket
• Using CloudWatch Alarms for anomalous activity
• Integrating with AWS Config to track configuration changes
• Retaining logs for a defined period that meets organizational policy

Without active monitoring, a PHI breach can go undetected for weeks. Automated alerts on privileged actions, bucket policy changes, and failed login attempts reduce that window.

Common Misconfigurations That Break Compliance

Most HIPAA violations on AWS trace back to configuration gaps rather than platform failures. The most frequent issues include public S3 buckets, unencrypted databases, overly broad IAM policies, disabled CloudTrail, and missing or expired BAAs. A single open bucket can expose millions of records and trigger HHS enforcement action.

Organizations should run regular configuration checks with AWS Config rules or third-party tools, remediate findings quickly, and maintain documentation that shows continuous diligence.

Summary

HIPAA compliance on AWS depends on a signed BAA, correct service selection, and rigorous configuration of access, encryption, and monitoring. AWS supplies the compliant foundation; the covered entity builds the secure workload on top of it. Ongoing governance, not a one-time setup, is what sustains compliance.