HIPAA compliance with AWS: easy or not?
Oleksandr Abharian
Scaling eCommerce on AWS | AWS Retail Competency | Founder & CEO of IT-Magic - AWS Advanced Consulting Partner | Helping eCommerce Brands Scale, Cut Costs & Handle Peak Traffic on AWS
AWS provides a range of HIPAA-eligible services, which means they have implemented appropriate safeguards and controls to protect PHI (protected health information). These services include Amazon Elastic Compute Cloud (EC2), Amazon Simple Storage Service (S3), Amazon Relational Database Service (RDS), and many others.
AWS has implemented a number of HIPAA security and compliance measures, including:
AWS has strict physical security measures in place to protect data centers where PHI is stored.
2. Network security
AWS uses firewalls, intrusion detection and prevention systems, and other security measures to protect the network infrastructure.
3. Access controls
AWS provides a range of tools to manage user access to PHI, including multi-factor authentication, identity and access management (IAM), and logging and monitoring.
4. Encryption
AWS provides encryption options for both data at rest and in transit, including Amazon S3 server-side encryption, Amazon RDS encryption, and AWS Key Management Service (KMS).
领英推荐
5. Audit controls
AWS provides tools for logging and monitoring access to PHI, including AWS CloudTrail and Amazon CloudWatch.
To help customers meet their compliance obligations, AWS also provides special resources and tools, including a HIPAA compliance whitepaper, a HIPAA compliance website, and HIPAA Business Associate Addendum (BAA) agreements.
Although AWS offers so many services, businesses should ensure that they are using these services in a HIPAA-compliant manner. It means that they should configure the services correctly and this is where professional AWS DevOps experts, like IT-Magic, can come to the rescue.
One of our latest clients, QliqSOFT, is a company in the US that provides secure communication between doctors, nurses, and patients.They contacted us with the request to migrate to AWS and set up a HIPAA-compliant system.?
One of the main technical challenges was the need of their development team to deploy several environments that were different and thus, the code behaved differently too.
The IT-Magic team unified environments, optimized environment deployment, ensured infrastructure scalability and cost optimization, accelerated development through automation (CI/CD), and made the system HIPAA compliant.
We used the following technologies: EKS, Terraform, S3, CloudFront, Aurora, OpenSearch, AWS CLoudTrail, Amazon GuardDuty, Amazon Inspector, Amazon Detective, AWS Config, AWS Security Hub
As a result, QliqSOFT reduced its operational costs and passed a HIPAA audit.?
With IT-Magic, it is easy to configure HIPAA compliance as we are certified AWS security experts and have practical experience as well. If you have any related questions don't hesitate to message me and we will discuss everything in detail.