Account architectureMulti-account structure separating production PHI workloads from development and staging.
IAM & least privilegeRoles scoped to what a service or person actually needs, with no standing admin access to PHI-bearing resources.
VPC & private networkingPHI-handling services kept off the public internet, reachable only through controlled entry points.
RDSEncrypted, private-subnet databases with automated backups and least-privilege database roles.
S3Encrypted buckets, blocked public access, and signed URLs for any PHI-bearing object.
KMS & encryptionCustomer-managed keys for PHI data, with a use policy that doesn’t leave keys sitting beside the data they protect.
CloudTrail & CloudWatchAccount-level and application-level activity captured and retained for audit and incident investigation.
Secrets managementAWS Secrets Manager or Parameter Store for credentials, rotated and never checked into source control.
Backups & disaster recoveryAutomated, encrypted backups with a documented and tested recovery process.
Security groups & network controlsExplicit allow-lists between services instead of broad, default-open network rules.
Infrastructure as codeTerraform-defined environments so configuration is reviewable, repeatable and auditable.
Container workloads (ECS/EKS)Container platforms configured with the same network isolation and IAM discipline as the rest of the account.
Not every AWS service is automatically HIPAA-eligible, and eligibility alone does not make a workload compliant — configuration, process and your Business Associate Agreement with AWS all matter.
