Emergency HIPAA Compliance Checklist for AWS: Technical Controls for PHI Protection and OCR Audit

Intro

HIPAA-regulated entities using AWS must implement specific technical safeguards for PHI as defined in 45 CFR Parts 160 and 164. Common gaps in S3 bucket policies, IAM role configurations, and VPC network controls create unauthorized access pathways. This dossier outlines failure patterns that directly contradict HIPAA Security Rule requirements for access control, audit controls, and transmission security.

Why this matters

Unsecured AWS resources containing PHI can increase complaint and enforcement exposure with the Office for Civil Rights (OCR), potentially resulting in Corrective Action Plans and civil monetary penalties. Market access risk emerges as business associates demand evidence of compliance. Conversion loss occurs when healthcare clients avoid partners with known compliance deficiencies. Retrofit costs escalate when addressing foundational infrastructure issues post-deployment.

Where this usually breaks

S3 buckets storing PHI without bucket policies enforcing least-privilege access or server-side encryption using AWS KMS. EC2 instances and Lambda functions processing PHI without proper IAM roles scoped to minimum necessary permissions. VPC configurations allowing public internet exposure of databases containing PHI. CloudTrail logs not enabled or encrypted, failing audit control requirements. Employee portals lacking session timeout controls and multi-factor authentication for PHI access.

Common failure patterns

Publicly accessible S3 buckets identified via tools like ScoutSuite or Prowler, often due to misconfigured bucket policies using 'Principal': ''. IAM policies with wildcard actions ('s3:') applied to roles accessing PHI storage. Missing encryption-in-transit for PHI moving between AWS services (e.g., Application Load Balancers without TLS 1.2 termination). Lack of automated backup and versioning for PHI in Amazon RDS, risking data loss. Failure to implement AWS Config rules for continuous compliance monitoring of HIPAA-required controls.

Remediation direction

Implement S3 bucket policies with explicit deny for non-HIPAA authorized principals, requiring encryption headers for PUT requests. Replace IAM wildcard permissions with granular actions (e.g., 's3:GetObject') limited to specific PHI resources. Deploy AWS Network Firewall or security groups to restrict database access to authorized VPCs only. Enable CloudTrail across all regions, log file integrity validation, and delivery to an S3 bucket with MFA delete. Configure AWS Backup for PHI databases with retention policies meeting HIPAA requirements. Use AWS Organizations SCPs to enforce encryption standards across accounts.

Operational considerations

Engineering teams must map AWS resources to specific HIPAA addressable and required implementation specifications. Regular automated compliance checks using AWS Security Hub with HIPAA-enabled controls require dedicated operational bandwidth. PHI data discovery across S3, RDS, and DynamoDB necessitates automated classification tools. Breach notification procedures must integrate with AWS GuardDuty findings and CloudWatch alarms. Employee portal access logs must be retained for six years per HIPAA, requiring Amazon CloudWatch Logs archival to S3 Glacier. Third-party vendor risk assessments must include AWS Marketplace solutions processing PHI.