HIPAA AWS Checklist: Controls You Need Before You Go Live

On April 23, 2026, HHS announced four ransomware settlements that totaled $1,165,000 and covered more than 427,000 people, according to HCI Innovation Group. Sidley’s analysis found all four cited the same failure: no accurate and thorough risk analysis before the breach. The attackers opened the investigations. The missing paper is what OCR wrote up.

That should change how you read your own dashboard. A HIPAA-compliant AWS setup is not the same thing as a green AWS Config board. Config can tell you a volume is encrypted. It cannot tell you that someone wrote the risk analysis, signed the vendor BAA, or restored a backup this quarter.

This checklist gives you 30 controls to verify before you go live. Each carries a tag for how firmly the rule expects it and a score for whether a scanner can check it. Sixteen of the thirty need a human somewhere in the loop.

The Rule Is Delayed. Your Exposure Is Not.

HHS proposed the big Security Rule overhaul on January 6, 2025. The HHS fact sheet says it would drop the split between required and addressable specifications, mandate multi-factor authentication and encryption (with limited exceptions), require a technology asset inventory and network map, set vulnerability scans every six months and penetration tests every year, and require network segmentation. It is still a proposal. HIPAA Journal reports that OMB’s agenda now lists final action for July 2027, a year later than planned, and Pact-One’s September 2026 status check still lists the rule as not final.

Do not read that as runway.

• AWS says build to the proposal. Its July 31, 2026 guidance still recommends treating every specification as Required for new workloads.
• OCR enforces the current rule now. HHS counts 13 completed Risk Analysis Initiative investigations and 19 ransomware investigations as of April 2026, and OCR’s director has confirmed the initiative expands to risk management this year. Expect the question to move from “did you write a risk analysis” to “what did you do about what it found.”
• The bill is real. The calendar-year penalty cap for violations of an identical provision is $2,190,294 for penalties assessed since January 28, 2026. IBM’s 2026 report puts the average healthcare breach at $6.64 million, the costliest industry for the 13th year running.

Every row in the table below carries one of three tags. Required means the current rule requires it. Addressable means the current rule lets you document an equivalent instead, which is not the same as optional. Proposed means the control is new or newly explicit in the 2025 proposal. Only 10 of the 30 rows are Proposed. The delay touches a third of the list.

Thirty Controls, Tagged and Scored

Here are the AWS security controls for healthcare that a hospital customer’s security team, an assessor, or OCR will ask you to prove. Tags follow the Security Rule standard each control implements, as AWS’s guidance maps them. This is engineering guidance, not legal advice, so confirm the tags with counsel.

The Scanner column scores whether a tool can verify the control. Yes means AWS Config, an SCP, or a Security Hub check can prove it. Partial means a tool proves the control is switched on and a person judges whether it is right. No means it lives in paper, process, or test evidence. The tally: 14 Yes, 8 Partial, 8 No.

Paper Controls a Scanner Will Never Pass

Controls 1 to 5 hold four of the eight No scores. They are also where OCR’s enforcement lives.

The Risk Analysis Decides Everything Else

AWS’s guide says you cannot scope the technical safeguards until the risk analysis exists, because the analysis decides which controls are reasonable and appropriate for your environment. Teams still write it last, as a document for the auditor. Write it first. Tie every risk on it to a row in the table, an owner, and a date. The proposal would go further and require the written assessment to review your asset inventory and network map, so start both now (control 3). Name your HIPAA Security Officer in the same document.

The AWS BAA Stops at AWS’s Edge

Accept the BAA once in the Organizations management account through AWS Artifact and it covers current and future member accounts. That is control 1, and it is the easy one. The BAA covers AWS’s side: the infrastructure and the managed service platforms. It says nothing about how you configure your workloads, and it does not reach third-party tools. AWS’s guide is explicit that an EDR agent bought through AWS Marketplace needs its own BAA with the vendor.

Now list everything else that touches ePHI: error tracking, log shipping, observability, support desks, analytics, AI APIs. Each needs a signed BAA before go live. The exposure is not theoretical. Business associates were involved in 43% of large healthcare breaches reported in the first half of 2026, against a 20% average from 2009 to 2017. To build your list, read your firewall egress logs and write down every external domain your PHI workloads call.

Boundary and test data. The ePHI boundary is the set of accounts where ePHI may live, and every account inside it needs the BAA. Keep development on synthetic or de-identified data. AWS’s guide says real ePHI does not belong in non-production systems unless they carry production safeguards.

Eligible services only. Check every service that touches PHI against AWS’s HIPAA Eligible Services Reference on the day you deploy, not the day you designed. Services in preview or beta are not eligible by default.

Identity: Where Shared Logins Hide

Shared Logins Are Invisible to AWS

CloudTrail records the IAM ARN and the federated session name for every API call, so AWS can tie an action to a named person, as long as each person has their own identity. AWS’s guide says plainly that AWS cannot enforce that part. Shared accounts, shared credentials, and shared workstation logins are yours to prohibit and to catch in access reviews. Check the places a scanner does not look: the shared admin login on your identity provider, the single database user baked into an application connection string, the jump box everyone uses. Quarterly reviews are the minimum AWS lists, so hold the first one before go live.

The Break-Glass Role Nobody Has Tested

Emergency access is a Required specification. AWS’s pattern is a dormant role with no routine trust. Two senior people release it by editing the trust policy, STS issues credentials for one hour at most, and the CloudTrail record gets reviewed within 24 hours. The trap is a role that has never been assumed. Its first real use happens during an outage, and that is when you find the typo in the trust policy. Run the drill before go live, keep the CloudTrail record as evidence, and repeat it every year.

Human access comes through IAM Identity Center connected to your identity provider, with an SCP that blocks IAM user creation in PHI accounts. Workloads use roles. MFA. Enforce it in Identity Center, add an SCP condition on aws:MultiFactorAuthPresent, and check root with the root-account-mfa-enabled rule. Verizon’s 2026 DBIR found that only 23% of third-party organizations fully fixed missing MFA on cloud accounts, so ask your vendors, too.

Encryption and Logging: Green Checks, Wrong Assumptions

Immutable Logs Full of PHI

AWS’s guide puts the audit trail in a Log Archive account with S3 Object Lock in compliance mode and a six-year retention period. Good pattern. Now read two other facts. The same guide warns that logs can contain ePHI, because application errors and query parameters leak patient identifiers. And the S3 documentation says a compliance-mode object cannot be deleted by any user, root included, and the only way to remove one before its retention date is to delete the AWS account. Put them together and one careless log line leaves you holding undeletable PHI for six years.

Split the log classes. Lock control plane logs, meaning CloudTrail and flow logs, in compliance mode. Keep application logs in a separate bucket under governance mode or a shorter retention period until you have proven your scrubbing works. That is my recommendation, not an AWS requirement, so record your reasoning in the risk analysis.

PHI in Names, Tags, and Keys

Encryption protects content. It does nothing for identifiers sitting in resource names, tags, object keys, log group names, and ARNs, and those values appear in logs, billing reports, IAM policies, and the console. AWS’s guide tells you to keep HIPAA identifiers out of all of them. An object key like lab-results/jane-doe/2026-05-01.pdf fails the test with encryption switched on. Put a naming standard in your templates and reject violations in CI.

At rest. Use customer managed KMS keys per account with rotation on, key policies that name who can decrypt, and SCPs that deny creating unencrypted S3 buckets, EBS volumes, and RDS instances. In transit. Terminate TLS 1.2 or higher on every listener, use ELBSecurityPolicy-TLS13-1-2-2021-06 or later as AWS’s guide recommends, and remove plain HTTP listeners or redirect them. Enforce SSL on RDS. Audit trail. Run an organization trail with S3 data events, validate log file integrity, and turn on VPC Flow Logs in every PHI VPC.

Recovery, Network, and Detection: Tools On, Nobody Watching

The Backup Nobody Has Restored

Versioning, Object Lock, RDS point-in-time recovery, DynamoDB PITR, and AWS Backup all show as enabled in a Config report. Only a restore proves they work. AWS’s guide lists restoration test evidence as a yearly minimum, and it flags the 2025 proposal’s 72-hour recovery time objective for critical systems. HHS also proposes separate technical controls for backup and recovery. Restore one real dataset into a scratch account before go live, time it, and write the number down. Copy backups to a second account and Region so one compromised account cannot take production and its backups together.

Two Products Named Security Hub

AWS shipped a new Security Hub in December 2025 that correlates signals from GuardDuty, Inspector, and Security Hub CSPM, and renamed the previous version Security Hub CSPM. Any tutorial written before that points at the wrong console. Turn on both. Then plan for two facts. Security Hub has no native HIPAA standard, so AWS’s HIPAA migration guidance pairs NIST SP 800-53 Rev. 5 with the Config HIPAA conformance pack. And existing automation rules need migration, because the new service uses the OCSF schema. Finally, name a human who reads the findings. A dashboard nobody triages is the risk management gap OCR is starting to ask about.

Network. Keep workloads in private subnets with no internet gateway attached, put the database tier in its own subnet, and run AWS Network Firewall deny by default in a central inspection VPC. Let security groups reference each other by group ID, and add an SCP that blocks 0.0.0.0/0 on ports 22, 3389, 1433, and 3306. Route AWS service traffic through VPC endpoints so instances need no outbound internet path. Detection. Enable GuardDuty organization-wide through a delegated administrator, with malware protection on for EC2 and S3. Amazon Inspector scans EC2, Lambda, and ECR images continuously and feeds Security Hub. Patching and testing. The proposal sets patch clocks of 15 calendar days for critical findings and 30 for high risk, so write those SLAs down now and log every exception. Verizon’s data, as summarized by HIPAA Journal, lists vulnerability exploitation at 20% of the healthcare attack vectors it tracked, ahead of phishing at 14%. Add a scan every six months and an annual penetration test. The proposal requires both.

Baseline in Code: What the Pipeline Owns and What It Misses

Every control above is a setting, and settings drift. The last three controls turn the list into something you can version, replay, and defend.

The Baseline in Version Control

The 2025 proposal wants technical controls that configure systems consistently against a baseline. AWS’s guide shows what that looks like. The Landing Zone Accelerator defines account structure, SCPs, security service settings, and network layout in YAML and deploys them with CDK and CloudFormation, so the baseline is repeatable and auditable by design. AWS also published the LZA Universal Configuration and a Compliance Workbook on AWS Artifact that maps the baseline to frameworks including HIPAA. Treat infrastructure as code for HIPAA as an evidence system first and a deployment convenience second. Your git history, pull request approvals, and pipeline runs answer the change management question before an assessor asks it. The catch is scale: a module with one overly broad security group ships that mistake to every account at the same speed. Run policy checks in the pipeline before apply, and scope the pipeline’s own role tightly, because it is now your most powerful identity.

Drift: What the Pipeline Never Sees

Code governs only what goes through it. Someone will change a security group in the console at 2 a.m. AWS Config records a timeline of every change to every in-scope resource, drift against the baseline becomes a Config finding that rolls up to Security Hub, and Systems Manager State Manager reapplies OS settings on a schedule. Two habits close the gap. Review the Config timeline for your PHI data stores weekly. And consider an SCP that allows security setting changes only from the pipeline role.

SCP Tamper Guards

Audit controls mean little if an admin can switch them off. AWS’s September 2026 HIPAA migration guidance lists the SCPs to deploy across the organization: deny cloudtrail:StopLogging and cloudtrail:DeleteTrail on the organization trail; deny config:DeleteConfigRule, config:DeleteConformancePack, and config:StopConfigurationRecorder; deny ec2:DeleteFlowLogs; block internet gateway creation in accounts that must stay private; and deny ePHI account actions without MFA. I would add guardduty:DeleteDetector and kms:ScheduleKeyDeletion. One trap: SCPs never restrict the management account, so nothing that touches PHI should run there. Test each guard by attempting the denied action from an admin role, and file the failed attempt as evidence.

Config Pack Parameters Someone Has to Own

AWS’s guide points to the HIPAA conformance pack for continuous evaluation and calls it more than 80 managed rules. As of September 2026, the template in AWS’s awslabs/aws-config-rules repository defines 130. AWS’s own Config documentation says the sample templates cannot guarantee compliance. The template ships defaults someone has to own, and it skips checks that AWS’s own evidence list expects:

Override parameters in code. In Terraform, the Cloud Posse conformance pack module takes a parameter_overrides map for exactly this. Its example pulls the template from the master branch of the AWS repository, so vendor the template into your repo or pin a commit. Then an upstream change arrives as a pull request instead of a surprise finding.

What the Numbers Say About Where Healthcare Breaks

Three findings run against the usual advice.

The delay removes 10 rows, not 30. Twenty rows are Required or Addressable today, and OCR enforces the current rule.

The penalized failures are on paper. All four April 2026 settlements cite the risk analysis, and 16 of the 30 controls need a human. The scanner-verifiable rows are the easy ones.

Stricter controls can raise your exposure. A compliance-mode lock on a bucket that collects PHI turns a logging mistake into a six-year liability.

Five Mistakes That Keep Repeating

Signing the BAA and stopping. It covers AWS’s side only. Every third-party tool in the ePHI path needs its own.

Reading the conformance pack score as a verdict. The score covers the rules in the pack. The gaps above sit outside it.

Running real PHI in development. AWS’s guide says to use synthetic data. If you migrate with AWS’s replication tooling, a test instance is a full copy of the source server, PHI included, and needs production controls.

Running workloads in the management account. SCPs do not reach it.

Treating Proposed rows as optional. AWS’s guide says to build encryption, MFA, and asset inventory in now rather than retrofit later.

Print the master table. Next to each row, write the evidence you could hand an assessor in an hour, and count the blanks. Start with the sixteen rows scored No or Partial, because those are the ones your dashboard will never flag. A HIPAA-compliant AWS setup is one where every blank has an owner and a date.