A lot of HIPAA compliance comes down to documentation, etc, for example getting AWS to sign BAA From a technical perspective, here are some highlights. Run ev

A lot of HIPAA compliance comes down to documentation, etc, for example getting AWS to sign BAA From a technical perspective, here are some highlights. Run everything in VPC, with private and public subnets only exposing bare minimum externally All disks are encrypted (we used dm-crypt) All data at rest on s3 or in flight is encrypted. Redundant encrypted backups Enable multi-form auth on AWS signin, audit IAM users Don't rely on external service providers for anything (except AWS of course) Make sure have an audit trail for everything. We log every action a user makes including the response.