AWS HIPAA Compliance Best Practices Checklist

Nowadays, most medical providers across the globe tend to implement cloud-based architecture for their medical services. And it’s not surprising, especially considering today's pandemic reality; medical software is a must. However, to build a highly secure solution to deliver medical services, you must abide by the US 1996 law, namely the HIPAA Security Rule. This legislation represents a set of required and adequate protections for managing electronic confidential patient information and avoiding its disclosure without prior patient's knowledge and even consent.

So if you want to develop a medical solution and make your health-care services cloud-based, you will have to apply the latest technologies for maintaining data compliance. To build cloud-based apps according to the Privacy Rule, most of the healthcare providers apply Amazon Web Services (AWS) due to its increased agility, security, and innovation potential.

Below we’ve prepared best practices and specific steps to consider when building an AWS medical web app. You can use these tips as your helpful AWS HIPAA checklist to ensure your product meets compliance terms. Keep reading!

Is AWS Cloud HIPAA Compliant?

New AWS users are usually wondering, "Is AWS HIPAA compliant?" Before we go to best practices, let's answer this important and quite complicated question.

To answer briefly, AWS alone doesn't guarantee HIPAA compliance, but it offers services that open the door for HIPAA compliance. Let's examine what this means.

Amazon supports HIPAA compliance, and you can utilize its reliable services to create a cloud-based solution that will manage, maintain, and transfer confidential patient information. However, it's not enough simply to use AWS. The main idea behind AWS HIPAA compliance is to have excellent knowledge of how to realize it in AWS, rather than simply using Amazon services. So, as a result, to deal with ePHI in a highly protected way, you should bear in mind the AWS HIPAA security rules and standards and, of course, correctly fit them.

Let's dive deep into the AWS HIPAA compliance best practices and learn a handy checklist that helps you build a medical solution with a high level of stability and protection.

AWS HIPAA Compliance Best Practices

Now let's look more closely at best practices that allow healthcare organizations to meet AWS HIPAA compliance.

Execute a Business Partner Agreement (BAA)

Before storing or managing any private medical records on AWS, you have to sign and execute a BAA with Amazon Web Services to verify that AWS delivers adequate protection of ePHI. BAA means Amazon Web Services share some of your legal obligations and guarantee that you’ll be informed of any data breach. To put it simply, you take care of the technological and executive protective measures of your platforms, operating systems, apps, and other solutions. As for AWS HIPAA compliant services, they are responsible for the security of their database, cloud, networks, and others.

Make patient data safe “at-rest” and while “in-transit”

If you want to protect your stored data, you should remember about encryption of all PHI data “in-transit” and “at-rest.” For this purpose, you can use SSL/TLS standards with very strong terms and policies. Besides, AWS allows developers to encrypt data with ease using AES-256 encryption. HIPAA dictates that all patient data is encrypted when “at-rest” and “in-transit,” so don't neglect this point when building a HIPAA compliant AWS solution.

Adopt required administrative policies according to your organization

If you're going to use Amazon Web Services HIPAA to develop your medical solution, you must realize all required administrative policies and safeguards. Applying administrative policies and procedures according to your organization is an essential part when implementing a HIPAA compliance solution. Such safety policies represent standard operating procedures (SOPs) that handle emergencies, private information, employee training, risk assessment, service outages, and address HIPAA administrative requirements.

Your team should properly follow these standard operating procedures within the organization. Moreover, you should review your administrative standards and policies periodically and update them according to entity and technology changes.

Remember — only you’re responsible for HIPAA

Despite Amazon AWS HIPAA tools being secure by default, you should always take into consideration the fact that just using Amazon cloud HIPAA services is not evidence of compliance. So what does it mean?

The point is that the essence of compliance isn't just about the services Amazon provides, but how good you are at using this compliance with AWS. So, if you misconfigure AWS services, you may run into a number of difficulties. For example, a misconfiguration has the potential to ePHI data vulnerability due to anyone with access to your stored data.

While AWS supports HIPAA compliance, it does not mean that your medical solution is free from risk. Your software service or cloud service can't be fully HIPAA compliant. In general, compliance is more about the result of using AWS rather than its features. You have to know for sure that you properly understand the AWS HIPAA security requirements.

When using AWS for HIPAA-compliant solutions, there is some advice to maximize your app’s stability and security and meet HIPAA requirements in AWS:

• Public access disablement;

• Configuration of logical boundaries between overall data and private patients' information;

• Patching schedule;

• Separating the processes related to patients information from orchestration ones;

• Turning encryption on for storage services such as Amazon RDS and Amazon Redshift.

Use only AWS ‘HIPAA-eligible’ services

Any medical entity should guarantee that they collect, manage, and handle all ePHI in HIPAA covered services. In the case of Amazon, they've provided a technical white paper that shows in detail how to build a medical solution using Amazon Web Services and reach HIPAA compliance. This paper provides a list of AWS ‘HIPAA-eligible’ cloud services that could be used with PHI. For example, you can utilize the Amazon Virtual Private Cloud service to get an isolated virtual network. One more web service, Amazon Elastic Compute Cloud (Amazon EC2), ensures reliable virtual computers in the cloud.

Keep a log of each user’s activity

Medical providers have to gather security events and audit logs with a view of safety and compliance. Collecting security events and audit logging makes it possible for you to have greater visibility and transparency in all actions occurring in your cloud-based services and organization.

Under the HIPAA rules, medical entities should know who got access to patients' health information and modified it. After all occurring changes, it's vital to have the opportunity to check that modifications were right, and the report is still relevant and up-to-date. Realization of audit logging and tracking controls is a must since, in case of a breach, you'll be able to generate reports with all logged transactions without difficulty.

Below we take a look at some of the audit logging for AWS that you need to gather for ensuring HIPAA compliance:

• AWS Access Logs — to collect individual AWS access for specific cloud services;

• AWS CloudTrail — to monitor user activity and API usage across the cloud environment;

• Cloud Compliance Logs — to control activities regarding safety configuration and detect any compliance and cloud security concerns;

• Availability with CloudWatch Logs — to monitor the overall availability of cloud services.

Take care of the backup process and disaster recovery implementation

Every healthcare provider must have an emergency plan in case of a disaster. To avoid any leak of private patients’ records and protect all collected, stored, and used ePHI data, you must ensure backed up and disaster recovery implementation. Fortunately, Amazon Web Services provides an opportunity to execute your backups. To manage your backups of data safely and securely, you can use such reliable services as Amazon S3 and Glacier. With AWS, you will be able to easily assure that your backup and recovery processes are configured properly. It's vital to bear in mind disaster recovery and data backup if you want to meet AWS HIPAA compliance requirements.

Don't forget to implement the authentication process

If you want to control and manage the actions users take in your app, you should take care of a reliable and secure authentication process. For example, you can use a trustworthy open standard like OAuth to provide a third party with limited access to protected resources. Or there is an open standard SAML for exchanging authentication and authorization data between an identity provider and a service provider. Also, you can try a technology solution like Identity and Access Management to securely manage the credentials of your users and control access to various applications and systems.

Our experience

TechMagic is an app development company that specializes in building fully-serverless or partially-serverless architecture for your product. Since 2017, we are a certified AWS Consulting Partner. To ensure scalable, cost-efficient infrastructure setup, we apply such services as AWS Lambda, API Gateway, AWS DynamoDB, AWS Step Functions.

Why use Serverless on AWS? Here are some of the great reasons:

• Cost-effective model. In case your product is not being used, you don't need to pay for the idle time. Your app just shuts down.

• Flexibility. Amazon Web Services allow you to choose the programming language, operating system, platform, and other specific services you require. This opportunity makes the app migration process easier.

• Scalability and high-performance. If your product needs scalability, AWS can do it automatically.

• Reliability and security. AWS takes a holistic approach that sought to protect and strengthen infrastructure involving operating, physical measures.

Besides, we’re proud to have hands-on knowledge and expertise in developing HealthTech solutions and HIPAA-compliant software.

Final thoughts

The number of healthcare providers who use AWS HIPAA-eligible services to guarantee a high healthcare service security level is growing every day. AWS has proved itself to be services are aligning themselves with the HIPAA, and they guarantee ePHI can be stored and processed without errors or any possible concerns. AWS, without a doubt, facilitates the process of building a consistent and solid cloud environment. But, even so, healthcare organizations must be confident of configuring AWS services accurately to accomplish all necessary security measures when building a medical solution on AWS. And to meet AWS HIPAA compliance and obtain a high level of security, you should apply the above mentioned best practices.

Are you looking for a tech partner to build a HIPAA-compliant AWS solution? Contact us and explain your idea!