Do we need Object Lock for PHI? HIPAA S3 retention: Object Lock compliance mode is not optional
✓ Human-authored analysis; AI used for formatting and proofreading. The thread repeats on r/aws: a team stores Protected Health Information (PHI) in S3, has versioning enabled, and assumes that's sufficient for retention. Someone suggests Object Lock. The team pushes back. It's complex and they already have lifecycle policies. The answer: Object Lock in Compliance mode is not optional for HIPAA…
Protected Health Information (PHI) stored in Amazon S3 requires specific retention rules under HIPAA regulations. A team thought versioning alone would suffice, but HIPAA requires 6 years of retention, with tamper-proof protection. Versioning can still allow data deletion, and lifecycle policies can remove versions before the retention period ends.
Object Lock in "Compliance" mode provides Write Once Read Many (WORM) protection. However, there are three different modes: Governance mode allows privileged overrides, and the retention period must be at least 6 years (2190 days). Stave, an evaluation tool, checks three controls:
1. If Object Lock isn't enabled on a compliance-tagged bucket (severity: MEDIUM)
2. If it uses Governance mode instead of Compliance (severity: MEDIUM)
3. If the retention period is shorter than 2190 days (severity: MEDIUM)
A bucket without Object Lock fails the first control. A bucket with Object Lock in Governance mode passes the first but fails the second. A bucket with Compliance mode and a 365-day retention period passes the first two but fails the third. To comply with HIPAA for PHI, an S3 bucket must have Object Lock in Compliance mode with a 2190-day minimum retention period.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.