A Minimum-Viable HIPAA Compliance Posture for AWS
Most HIPAA-on-AWS guides are overwhelming. The minimal posture that passes audit and lets engineering keep moving is twelve controls, grouped across account architecture, identity, data protection, and observability.
Control-mapping checklist
Copy as markdown to paste into your repo, or download a branded PDF for sharing with non-technical stakeholders.
Frequently asked questions
What is the minimum HIPAA setup on AWS?
A defensible minimum is twelve technical controls across four areas: account architecture (separate workload, log-archive, and audit accounts plus SCPs), identity (MFA everywhere, locked root, least-privilege roles), data (KMS encryption at rest and TLS 1.2+ in transit), and observability (an org-wide CloudTrail shipped to a tamper-proof log archive). Sign the AWS BAA before any of it.
Do I need a BAA with AWS for HIPAA?
Yes. Sign the AWS Business Associate Addendum in AWS Artifact before you store or transmit PHI. Without it you have no legal coverage, and it only extends to AWS's HIPAA-eligible services.
Which AWS services are HIPAA-eligible?
Only the services AWS lists as HIPAA-eligible (around 150 today) are covered by the BAA; using anything else to handle PHI steps outside it. The list changes over time, so verify eligibility as a runtime check rather than trusting a one-time decision.
How many AWS accounts do I need for HIPAA?
At least three: a workload account for PHI, a separate log-archive account, and an audit or security account, tied together with AWS Organizations SCPs. That split gives traceable production access, tamper-proof logs, and contained blast radius.
Is AWS-managed KMS enough for HIPAA, or do I need customer-managed keys?
AWS-managed KMS keys are acceptable for a minimum-viable HIPAA posture. Customer-managed keys with rotation become worthwhile once you are large enough that key-access auditing matters.
What HIPAA controls can I skip at first?
SIEM, GuardDuty, Macie, WAF, and third-party CSPM tooling all add value but are not required for a defensible day-one posture. Add them when the audit cycle starts to feel painful.
Get the next one.
New operating guides as we publish them — practical, infrequent, unsubscribe in one click.
MVP is the starting line, not the finish.
Kaan Systems does platform engineering and Terraform for funded SaaS, health-tech, and fintech. Compliance evidence is the by-product of that work. The Teardown scores the twelve controls against the accounts you have. The Architecture and Compliance Teardown is a written read in about five business days. Book a call.