HIPAA Cloud Security: AWS, Azure & GCP Compliance Guide

Quick Answer: HIPAA-compliant cloud hosting requires: (1) Business Associate Agreement (BAA) signed with provider, (2) Data encryption at rest (AES-256) and in transit (TLS 1.2+), (3) Customer-managed encryption keys, (4) Strong access controls with IAM policies, (5) VPC/network isolation, (6) Comprehensive audit logging, (7) Regular penetration testing, (8) Data residency compliance. AWS, Azure, and GCP all offer HIPAA-eligible services with proper configuration.

HIPAA Cloud Compliance Fundamentals

HIPAA doesn't prohibit cloud computing. Healthcare organizations can use AWS, Azure, Google Cloud, and other providers if properly configured. The key requirement: Business Associate Agreements (BAA) and proper technical and administrative safeguards.

Cloud compliance means: (1) Cloud provider signs BAA, (2) You encrypt data, (3) You control encryption keys, (4) You implement access controls, (5) You maintain audit logs.

Business Associate Agreements (BAA)

BAA Requirements

A BAA is a contract between your organization and the cloud provider. It specifies:

  • What PHI can be processed: Scope of services and data types
  • Data uses: Only for stated business purposes
  • Security safeguards: Provider implements HIPAA-required technical controls
  • Data subcontractors: Any vendors the provider uses must also sign BAAs
  • Breach notification: Provider notifies you of breaches immediately
  • Termination provisions: Data handling upon contract end
  • Audit rights: You can audit provider's HIPAA compliance
  • Data destruction: Certified destruction or return of PHI on termination

Cloud Providers with HIPAA BAAs:

  • AWS: BAA available for all account types
  • Microsoft Azure: BAA included for Healthcare and Life Sciences SKU
  • Google Cloud: BAA available (enterprise agreement required)
  • Salesforce: BAA available for Health Cloud
  • Oracle Cloud: BAA available

BAA Not Required For: Cloud providers you don't use for PHI (e.g., using GitHub for source code only, not containing PHI)

AWS HIPAA Compliance

AWS Services Eligible for HIPAA

Compute Services:

  • EC2 (Elastic Compute Cloud)
  • RDS (Relational Database Service)
  • DynamoDB (NoSQL Database)
  • Lambda (Serverless Functions)
  • Elastic Beanstalk

Storage Services:

  • S3 (Simple Storage Service)
  • EBS (Elastic Block Store)
  • Glacier (Archive Storage)
  • EFS (Elastic File System)

Security & Compliance Services:

  • KMS (Key Management Service)
  • CloudTrail (Audit Logging)
  • IAM (Identity & Access Management)
  • Secrets Manager

AWS HIPAA Architecture Example:

VPC (Virtual Private Cloud)
├── Private Subnets (EC2/RDS)
├── NAT Gateway (outbound access)
├── VPC Endpoints (S3, KMS access without internet)
├── Security Groups (firewall rules)
└── Network ACLs (subnet-level rules)

Encryption:
├── RDS: AWS KMS encryption + encrypted snapshots
├── S3: Server-side encryption (SSE-KMS)
├── EBS: Encrypted volumes
└── In-transit: TLS 1.2+ for all connections

Access Control:
├── IAM Roles: Least privilege principles
├── MFA: Required for privileged actions
└── CloudTrail: All API calls logged

AWS KMS Configuration for PHI:

Key Management:
- Customer Master Key (CMK) in AWS KMS
- Key rotation: Enabled (annual)
- Key policy: Restrict access to authorized IAM roles
- CloudTrail: Log all key usage

RDS Encryption Example:
aws rds create-db-instance \
--db-instance-identifier phi-database \
--storage-encrypted \
--kms-key-id arn:aws:kms:region:account:key/id \
--enable-cloudwatch-logs-exports error,general,slowquery

Microsoft Azure HIPAA Compliance

Azure Services for HIPAA

Healthcare-Specific Services:

  • Azure API for FHIR (health data interoperability)
  • Azure Health Data Services
  • Azure Bot Service (healthcare chatbots)

General Compute Services:

  • Virtual Machines
  • Azure SQL Database
  • Cosmos DB
  • App Service
  • Functions (serverless)

Storage Services:

  • Blob Storage (S3 equivalent)
  • Managed Disks (encrypted storage)
  • File Share

Azure HIPAA Compliance Configuration:

Resource Groups:
- Separate production and non-production
- IAM roles per environment
- Encryption enforced via policy

Network Security:
- Virtual Network (VNet) isolation
- Network Security Groups (NSG)
- Azure Firewall for DDoS protection

Encryption:
- Transparent Data Encryption (TDE) for SQL
- Storage Service Encryption (SSE)
- Encryption at Rest: Customer-managed keys (CMK)
- Encryption in Transit: TLS 1.2+ enforced

Access Control:
- Azure AD (Entra ID) for authentication
- Role-Based Access Control (RBAC)
- Conditional access policies
- MFA enforcement for sensitive operations

Azure Key Vault Setup:

az keyvault create \
--resource-group phi-rg \
--name phi-vault \
--enable-purge-protection \
--enabled-for-disk-encryption \
--enabled-for-deployment

Google Cloud Platform HIPAA Compliance

GCP Services for Healthcare

Healthcare-Specific Services:

  • Cloud Healthcare API (DICOM, HL7, FHIR)
  • BigQuery for healthcare analytics
  • Cloud Life Sciences

General Services:

  • Compute Engine
  • Cloud SQL
  • Cloud Storage
  • App Engine
  • Cloud Run

GCP HIPAA Architecture:

VPC Network:
- VPC per project isolation
- Firewall rules per subnet
- VPC Peering for multi-project setup
- Cloud Armor for DDoS protection

Encryption:
- Google-managed keys (default)
- Customer-managed keys (CMEK) recommended
- Cloud KMS for key management

Data Protection:
- Persistent Disk encryption (default)
- Cloud Storage encryption (default)
- In-transit: TLS 1.2+ required

Monitoring & Compliance:
- Cloud Audit Logs (all API activity)
- Data Loss Prevention API
- Cloud Identity for IAM

Data Encryption in Cloud

Encryption at Rest Requirements

Key Management Best Practices:

  1. Customer-managed keys (CMK): You control key access and rotation
  2. Separate from data: Keys stored in key management service, not with data
  3. Key rotation: Rotate keys annually (or per organizational policy)
  4. Access logging: Log all key usage in audit system
  5. Backup keys: Store escrow copy for disaster recovery

Never use provider-managed keys for PHI unless unavoidable.

Encryption in Transit Requirements

  • Protocol: TLS 1.2 or 1.3 required
  • Certificates: Valid, non-self-signed certificates
  • Cipher Suites: AES-256-GCM or equivalent
  • Perfect Forward Secrecy: Ephemeral key exchange required
  • Validation: Certificate hostname verification enforced

Testing: Use SSL Labs or similar tools to validate TLS configuration.

Cloud Access Controls

Identity & Access Management (IAM)

IAM Principles:

  1. Least privilege: Users get minimum permissions needed
  2. Role-based access: Assign roles, not individual permissions
  3. Principle of separation: No single person can authorize and approve
  4. Regular review: Quarterly audit of all access grants
  5. Privileged accounts: Separate admin accounts from regular use

Example IAM Structure:

Roles:
- Developer: Read databases, deploy code
- DBA: Full database admin (with MFA + approval)
- Security: Audit logs, encryption key management
- Operator: Application management (read-only for data)

Condition: All privileged operations require:
- Multi-factor authentication
- Approval workflow
- Audit trail logging

Cloud Compliance Auditing

Audit Logging Requirements

  • All PHI access logged: API calls, database queries, file access
  • 6+ year retention: Log storage for audit trail compliance
  • Tamper protection: Logs write-protected and encrypted
  • Centralized logging: SIEM aggregation of all cloud logs
  • Real-time monitoring: Alerts for unusual activity
  • Regular review: Monthly audit log analysis

What to Log from Cloud Systems:

  • All data access and modifications
  • User authentication and authorization
  • Configuration and security setting changes
  • Backup and restore operations
  • Encryption key access
  • IAM permission changes

Frequently Asked Questions

Can we host HIPAA data on default AWS/Azure/GCP accounts without special configuration? ▼

No. Default configurations don't meet HIPAA requirements. You must: (1) Sign a BAA before processing PHI, (2) Implement customer-managed encryption with your keys, (3) Configure IAM with least privilege, (4) Enable audit logging, (5) Implement network segmentation, (6) Configure data residency compliance, (7) Set up encryption key management. Don't assume "enterprise grade" means HIPAA-ready. Default settings often leave logging disabled and use provider-managed encryption (you can't control key access).

Is cloud storage acceptable for HIPAA backups? ▼

Yes, cloud backup is fine if properly encrypted. Requirements: (1) Use customer-managed encryption (you control keys), (2) Provider signed BAA, (3) Encryption during transfer and storage, (4) Verify backup integrity regularly, (5) Test restore procedures quarterly, (6) Maintain encryption keys separately from backups, (7) Document backup procedures. Many organizations use AWS S3 with KMS encryption or Azure Backup with CMK. Advantage: automatic redundancy, geographic distribution, disaster recovery capabilities.

What if a cloud provider subcontracts services? ▼

All subcontractors must also sign BAAs. Your BAA with the cloud provider should explicitly require: (1) The provider lists all subcontractors, (2) Subcontractors sign BAAs before processing PHI, (3) Provider ensures subcontractor compliance, (4) You're notified of any subcontractor changes. Most cloud providers handle this—AWS Subcontractors are listed and required to maintain HIPAA compliance. Don't assume the provider has handled this; verify in your BAA and request the subcontractor list.

Can we use cloud infrastructure only for non-sensitive data (backups, analytics)? ▼

Yes, non-PHI data doesn't require HIPAA controls (though good security is still recommended). However, be careful: (1) De-identified data still requires caution (HIPAA defines re-identification risk), (2) Backup metadata may contain PHI, (3) Logs of PHI access contain sensitive information. Use risk analysis to determine what requires HIPAA compliance. When in doubt, treat as PHI. Cloud analytics require BAA if analyzing PHI data, even if individual records aren't identifiable.

Implementation Checklist

  • [ ] Select cloud provider and sign HIPAA BAA
  • [ ] Verify provider's BAA covers all services used
  • [ ] Plan cloud architecture with security requirements
  • [ ] Implement network segmentation (VPC/VNet)
  • [ ] Configure customer-managed encryption keys
  • [ ] Enable encryption at rest for all data stores
  • [ ] Enforce encryption in transit (TLS 1.2+)
  • [ ] Configure IAM with least privilege roles
  • [ ] Enable MFA for privileged accounts
  • [ ] Implement comprehensive audit logging
  • [ ] Configure centralized log aggregation/SIEM
  • [ ] Set up CloudTrail/audit log analysis
  • [ ] Plan and test disaster recovery procedures
  • [ ] Conduct initial cloud security assessment
  • [ ] Schedule annual cloud compliance audit
  • [ ] Document cloud security architecture