Is my S3 bucket HIPAA compliant? The question AWS can't answer
✓ Human-authored analysis; AI used for formatting and proofreading. Recurring theme on r/aws: "I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?" The top reply is always some version of: "AWS won't tell you that. You need to evaluate your configuration against the Security Rule yourself." That reply is correct and does not help.…
The HIPAA Security Rule does not specifically mention Amazon S3 as a system that must comply. Instead, it outlines four main categories of safeguards that apply to any system storing electronic protected health information (ePHI): access control, audit controls, encryption, and retention.
While encryption at rest is a straightforward checkbox (using AWS Key Management Service), determining if an S3 bucket meets HIPAA compliance requires customers to evaluate their own configurations. AWS provides tools like Stave, an open-source CLI, which evaluates S3 settings against HIPAA compliance profiles. This tool generates a pass/fail report with citations to the specific Security Rule sections and remediation steps.
Stave's HIPAA profile maps 28 controls to the Security Rule sections, enabling auditors to trace compliance back to the regulation. AWS handles the encryption, logging, and access control infrastructure, but the responsibility for determining whether the specific configuration meets HIPAA standards rests with the customer.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
