# HIPAA on AWS — Engineering Build Checklist (July 2026)

Not legal advice. Confirm **HIPAA Eligible Services** + **AWS BAA via Artifact** before PHI.

## Gate 0

- [ ] BAA accepted in AWS Artifact for the account(s)
- [ ] Architecture uses only HIPAA-eligible services for PHI paths
- [ ] Separate PHI accounts / OUs where practical

## Data protection

- [ ] Encryption at rest: S3, RDS/Aurora, EBS, backups — CMK preferred
- [ ] TLS everywhere PHI moves (ALB/API Gateway, DB, logs)
- [ ] Secrets Manager / SSM for credentials — no plaintext env for PHI keys

## Audit & access

- [ ] Org multi-region CloudTrail + validation + CMK
- [ ] VPC Flow Logs; CloudWatch Logs retention policy
- [ ] Least-privilege IAM; no long-lived access keys for humans
- [ ] Config + Security Hub (or equivalent) continuous checks

## Counter-case

Encryption without a BAA is **not** HIPAA compliance. Eligible-service list is live — re-check before new services.