{
  "id": 15601875,
  "title": "Is my S3 bucket HIPAA compliant? The question AWS can't answer",
  "url": "https://urgent.news/2026/10/19/is-my-s3-bucket-hipaa-compliant-the-question-aws-cant-answer",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T12:19:26.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/bala_paranj_059d338e44e7e/is-my-s3-bucket-hipaa-compliant-the-question-aws-cant-answer-ci9"
  },
  "original_language": "en",
  "account": "The HIPAA Security Rule does not specifically mention Amazon S3 as a system that must comply. Instead, it outlines four main categories of safeguards that apply to any system storing electronic protected health information (ePHI): access control, audit controls, encryption, and retention.\n\nWhile encryption at rest is a straightforward checkbox (using AWS Key Management Service), determining if an S3 bucket meets HIPAA compliance requires customers to evaluate their own configurations. AWS provides tools like Stave, an open-source CLI, which evaluates S3 settings against HIPAA compliance profiles. This tool generates a pass/fail report with citations to the specific Security Rule sections and remediation steps.\n\nStave's HIPAA profile maps 28 controls to the Security Rule sections, enabling auditors to trace compliance back to the regulation. AWS handles the encryption, logging, and access control infrastructure, but the responsibility for determining whether the specific configuration meets HIPAA standards rests with the customer.",
  "summary": "✓ Human-authored analysis; AI used for formatting and proofreading. Recurring theme on r/aws: \"I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?\" The top reply is always some version of: \"AWS won't tell you that. You need to evaluate your configuration against the Security Rule yourself.\" That reply is correct and does not help.…",
  "key_points": [
    "HIPAA Security Rule outlines four safeguard categories for ePHI storage.",
    "AWS Key Management Service enables encryption at rest for S3 buckets.",
    "Stave CLI tool assesses S3 configurations against HIPAA compliance."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}