Cloud Compliance Services — HIPAA, SOC 2 & PCI DSS on AWS

Compliance on AWS Is Not Automatic

AWS provides HIPAA-eligible services, maintains PCI DSS Level 1 certification, and publishes SOC 2 reports. This is often misread as “AWS is compliant, so we are compliant.”

The AWS shared responsibility model divides security and compliance responsibility between AWS and you. AWS secures the underlying infrastructure — physical data centers, hypervisors, network hardware, and the managed service layer. You are responsible for everything you configure: encryption settings, access policies, logging configurations, network security groups, and application-level controls.

Every compliance audit of an AWS workload is, in effect, an audit of how you have configured AWS services — not of AWS itself. Our cloud compliance services close the gap between a default AWS environment and an audit-ready one.

HIPAA Compliance on AWS

The Health Insurance Portability and Accountability Act (HIPAA) applies to any organization that creates, receives, maintains, or transmits Protected Health Information (PHI). On AWS, HIPAA compliance requires:

Business Associate Agreement (BAA): You must sign an AWS BAA before using HIPAA-eligible services for PHI. The BAA defines which AWS services are covered. Using non-eligible services for PHI processing violates HIPAA, even if those services are otherwise secure.

HIPAA-eligible services: AWS maintains a list of services covered under the BAA. This includes core services like EC2, S3, RDS, Lambda, and API Gateway — but not all AWS services. Architecture must be limited to eligible services for any PHI processing.

Technical safeguards:

• Encryption at rest using AWS KMS for all PHI data stores (S3 SSE-KMS, RDS encryption, EBS encryption)
• Encryption in transit with TLS 1.2+ enforced, no unencrypted protocols
• Unique user identification with MFA enforcement — no shared accounts
• Automatic logoff for workstations and consoles
• Audit controls: CloudTrail logging for all API activity, VPC Flow Logs, S3 access logging

Administrative safeguards: HIPAA requires not just technical controls but documented policies and procedures — workforce training records, risk analysis documentation, incident response procedures, and business associate agreements with all downstream vendors.

SOC 2 Type II on AWS

SOC 2 Type II certification demonstrates to enterprise customers and partners that your organization maintains effective security controls over a defined period. The five Trust Service Criteria:

Security (required) — Protecting against unauthorized access. AWS controls: IAM least privilege, MFA enforcement, VPC isolation, Security Groups, GuardDuty, CloudTrail.

Availability — System uptime and performance commitments. AWS controls: Multi-AZ deployments, Auto Scaling, Route 53 health checks, CloudWatch alarms.

Confidentiality — Protecting confidential information. AWS controls: KMS encryption, S3 bucket policies, data classification tagging, access logging.

Processing Integrity — Complete and accurate processing. AWS controls: Step Functions error handling, SQS dead-letter queues, Lambda retry logic, data validation.

Privacy — Collection, use, and retention of personal information. AWS controls: Macie for PII discovery, S3 lifecycle policies, data deletion automation.

Most SOC 2 engagements focus on Security and one or two additional criteria. We implement the controls, configure AWS Config rules that monitor for compliance drift, and maintain the evidence records your auditor needs.

PCI DSS on AWS

Payment Card Industry Data Security Standard compliance is required for any organization that processes, stores, or transmits cardholder data. PCI DSS v4.0 consists of 12 requirements spanning network security, access control, logging, vulnerability management, and information security policies.

Cardholder Data Environment (CDE) scoping is the most important architectural decision. The smaller your CDE, the smaller your audit scope. AWS architecture options for scope reduction:

• Use Stripe, Braintree, or Adyen to handle card capture and tokenization — keeping raw card data entirely outside your environment
• Isolate remaining payment processing in a dedicated AWS account or VPC
• Implement network segmentation between CDE and non-CDE components

AWS services for PCI DSS:

AWS Security Hub includes a built-in PCI DSS compliance standard that maps Config rules to PCI requirements, providing continuous automated compliance assessment.

For fintech-specific AWS architecture, see our guide on PCI DSS Compliance on AWS for Fintech.

Our Compliance Delivery Process

Step 1: Gap Assessment (1–2 weeks)

Structured review of your current AWS environment against your target framework:

• Security control inventory
• AWS Config rule evaluation
• Security Hub findings review
• IAM policy analysis
• Network architecture review
• Encryption coverage audit
• Logging completeness check

Output: Prioritized gap report with control mapping and estimated remediation effort for each gap.

Step 2: Remediation (4–12 weeks)

Hands-on implementation of required controls, in priority order:

• IAM policy hardening and MFA enforcement
• Encryption at rest and in transit
• Logging and monitoring configuration
• Network segmentation and security group hardening
• Automated compliance monitoring with AWS Config and Security Hub
• Secrets Manager migration (replacing hardcoded credentials)
• Vulnerability scanning setup

Step 3: Audit Readiness (1–2 weeks)

Preparation for formal audit engagement:

• Evidence package organization (screenshots, Config snapshots, policy documents)
• Control narrative documentation
• Auditor readiness review
• Remediation of final gaps identified in readiness review

Step 4: Ongoing Monitoring

Compliance is not a one-time event. After certification, we maintain:

• AWS Security Hub compliance standard monitoring
• Config rule enforcement for new resources
• Quarterly access reviews
• Annual risk assessment updates
• Compliance drift alerts

Industry Focus

Healthcare — HIPAA BAA establishment, PHI data flow mapping, HITRUST alignment for organizations pursuing HITRUST CSF certification. See our AWS Healthcare industry page.

Fintech — PCI DSS CDE scoping and remediation, SOC 2 for payment platforms, FFIEC guidance for financial services. See our AWS Fintech industry page.

SaaS — SOC 2 Type II as a sales requirement for enterprise customers. Most B2B SaaS companies pursue SOC 2 by their Series B or when closing enterprise deals.

EdTech — FERPA compliance for student data, COPPA for applications serving users under 13, combined with SOC 2 for enterprise school district customers.

For the full security stack that underpins compliance, see our AWS Security Consulting service. For the architecture review that often precedes a compliance engagement, see AWS Well-Architected Review.

For comprehensive reading on HIPAA requirements, see our HIPAA on AWS Complete Compliance Checklist.

Book a Free Compliance Gap Assessment →