HIPAA Compliant Cloud Hosting Guide

AWS, Azure, GCP HIPAA Compliance, BAA Requirements & Architecture Best Practices

Quick Answer

Major cloud providers (AWS, Azure, GCP) offer HIPAA compliant services under Business Associate Agreements. Compliance requires proper region selection, encryption configuration, access controls, audit logging, and architectural decisions aligned with HIPAA technical safeguards.

Cloud Provider HIPAA BAA Overview

AWS HIPAA Eligibility

AWS offers HIPAA eligible services in specific regions (US regions only). HIPAA BAA covers EC2, S3, RDS, and 150+ other services. Requires HIPAA account enablement.

Microsoft Azure HIPAA

Azure provides HIPAA compliant services globally. HIPAA BAA required. Compliance Manager tool assists with continuous compliance monitoring and assessment.

Google Cloud HIPAA

GCP offers HIPAA BAA for specific services. Limited service availability compared to AWS. Growing HIPAA compliance capability. BAA covers Compute Engine, Cloud Storage, BigQuery.

AWS HIPAA Compliance Architecture

HIPAA Eligible Services & Configuration +

Compute: EC2 (with encryption), Lambda, Elastic Beanstalk
Storage: S3 (with encryption), EBS (encrypted volumes)
Database: RDS (encrypted), DynamoDB (encrypted)
Networking: VPC, CloudFront, VPN, API Gateway
Security: IAM, KMS, Secrets Manager, CloudTrail
Compliance: Config, Security Hub, GuardDuty

AWS Encryption Requirements +

Data at Rest: S3 encryption (SSE-KMS recommended), RDS encryption, EBS encryption
Data in Transit: HTTPS/TLS 1.2+, VPN for inter-region communication
Key Management: AWS KMS for key generation and rotation
Asymmetric Keys: Use customer-managed keys (CMK) rather than default encryption

AWS Access Control Implementation +

IAM policies with principle of least privilege
Multi-factor authentication for sensitive operations
Resource-level permissions and tags for separation of duties
Service Control Policies (SCPs) for organizational guardrails
IAM Access Analyzer for permission verification

Azure HIPAA Compliance Architecture

Azure HIPAA Eligible Services +

Compute: Virtual Machines, App Service, Container Instances
Storage: Blob Storage (encrypted), Disk Storage (encrypted)
Database: SQL Database (encrypted), Cosmos DB (encrypted)
Networking: VNet, Application Gateway, Azure Firewall
Security: Azure AD, Key Vault, Azure DDoS Protection
Monitoring: Monitor, Log Analytics, Azure Sentinel

Azure Encryption & Key Management +

At Rest: Storage encryption (AES-256), SQL TDE, Disk encryption
In Transit: HTTPS enforcement, TLS 1.2+, VPN gateways
Key Vault: Centralized key and secret management
Customer-Managed Keys: BYOK (Bring Your Own Key) for additional control
Disk Encryption Sets: Manage encryption keys for managed disks

Azure RBAC & Identity Management +

Role-Based Access Control (RBAC) with built-in roles
Azure AD authentication with MFA enforcement
Conditional Access policies for risk-based authentication
Privileged Identity Management (PIM) for just-in-time access
Service principals and managed identities for applications

Google Cloud HIPAA Architecture

GCP HIPAA Eligible Services +

Compute: Compute Engine, App Engine, Cloud Functions
Storage: Cloud Storage (encrypted), Persistent Disks (encrypted)
Database: Cloud SQL, Firestore, BigTable
Networking: VPC, Cloud CDN, Cloud VPN
Security: Cloud IAM, Secret Manager, Cloud Armor
Monitoring: Cloud Logging, Cloud Monitoring, Cloud Trace

GCP Encryption Best Practices +

Default Encryption: Google-managed keys with automatic rotation
CMEK (Customer-Managed Encryption Keys): Cloud KMS for key control
Transport Security: Automatic HTTPS, TLS 1.2+ for internal traffic
Key Rotation: Automatic or manual rotation policies
Application-Layer Encryption: Additional encryption before cloud storage

Cloud Provider Comparison

Feature	AWS	Azure	GCP
HIPAA BAA Available	Yes	Yes	Yes
Service Count	150+	100+	50+
Encryption Flexibility	High (KMS)	High (Key Vault)	High (Cloud KMS)
Audit Logging	CloudTrail	Activity Logs	Cloud Audit Logs
Compliance Tools	Config + Security Hub	Compliance Manager	Compliance Manager

Multi-Region & High Availability Architecture

HIPAA Region Requirements +

AWS: Use US regions only (us-east-1, us-west-2, etc.). No international regions for HIPAA.
Azure: Any region acceptable but verify contract compliance with state laws
GCP: US regions recommended; verify specific service availability
Avoid public cloud regions in countries with data residency restrictions

Disaster Recovery Architecture +

RTO/RPO Definition: Define recovery time and point objectives in advance
Geographic Redundancy: Replicate across multiple availability zones or regions
Database Replication: Use native replication (RDS Multi-AZ, Azure geo-replication)
Automated Failover: Implement health checks and auto-failover mechanisms
Backup Strategy: Daily incremental, weekly full, encrypted backups
Disaster Recovery Testing: Quarterly DR drills with documented results

Audit Logging & Monitoring Requirements

AWS Audit Logging

CloudTrail captures all API calls (management events). CloudTrail Insights detects unusual activity. Application logging to CloudWatch. Enable MFA Delete on S3 buckets.

Azure Audit Logging

Activity Logs capture control plane operations. Log Analytics workspace for aggregation. Diagnostic Settings for service-level logging. Azure Sentinel for threat detection.

GCP Audit Logging

Cloud Audit Logs capture API calls and admin activity. Cloud Logging for application logs. Log Analytics for querying. Cloud Monitoring for alerts.

Network Security & Isolation

Virtual Network Architecture +

Private subnets for database resources
Public subnets for web tier with NAT gateways
Security groups/Network ACLs limiting traffic
VPC Flow Logs for network monitoring
Hybrid connectivity via VPN or Direct Connect

DDoS Protection & Web Application Firewall +

AWS: AWS Shield Standard (automatic), Shield Advanced (optional)
Azure: Azure DDoS Protection Standard with Advanced Attack Analytics
GCP: Cloud Armor with DDoS protection and WAF rules
WAF rules to block common attack patterns (OWASP Top 10)

HIPAA Compliance Checklist

Executed HIPAA BAA with cloud provider

All data encrypted at rest with customer-managed keys

All data in transit encrypted with TLS 1.2+

Access controls implemented with least privilege principles

Multi-factor authentication enabled for administrative access

Audit logging enabled and logs retained for 6+ years

Disaster recovery plan documented and tested quarterly

Vulnerability scanning and patching process implemented

Data residency limited to HIPAA-eligible regions

Incident response procedures documented and communicated

Key Takeaways

All major cloud providers offer HIPAA-eligible services under BAA
Encryption configuration is critical for compliance - use customer-managed keys
Regional restrictions apply to AWS (US regions only) but not other providers
Audit logging must be enabled and monitored continuously
Disaster recovery plans require regular testing and documentation