3 ms·
Love to hear more about HIPAA compliance on AWS, been there recently and would love to see other's take on it. Especially because the AWS whitepaper is so....un
by maxmmurphy 13y ago
Love to hear more about HIPAA compliance on AWS, been there recently and would love to see other's take on it. Especially because the AWS whitepaper is so....unsubstantial.
- deleted 13y ago[deleted]
- johne20 13y agoA lot of HIPAA compliance comes down to documentation, etc, for example getting AWS to sign BAA From a technical perspective, here are some highlights. Run everything in VPC, with private and public subnets only exposing bare minimum externally All disks are encrypted (we used dm-crypt) All data at rest on s3 or in flight is encrypted. Redundant encrypted backups Enable multi-form auth on AWS signin, audit IAM users Don't rely on external service providers for anything (except AWS of course) Make sure have an audit trail for everything. We log every action a user makes including the response.