What Counts as PHI on AWS and How to Handle Itc

What Counts as PHI on AWS and How to Handle It

A developer adds one line to a Lambda function on a Friday: log the full request body so we can debug the intake form. By Monday, patient names, birth dates, and free text symptom descriptions sit in a CloudWatch log group that fifteen engineers can query and a vendor receives through a subscription filter. Nobody has classified any of it. Your BAA is signed. Your S3 buckets are encrypted. You still have an exposure.

This is where PHI protection on AWS usually fails. Not at the perimeter, but in the places nobody labeled as patient data. Fixing it starts with what the law counts as PHI, then finding where that data actually lands in your account.

PHI Depends on Context, Not Column Names

Protected health information is health data tied to an identifier, held by a covered entity or a business associate. The Safe Harbor standard in 45 CFR 164.514(b)(2) lists 18 identifier categories. According to the regulatory summary at d3rx, they include names, geographic units smaller than a state, every date element except year, phone and fax numbers, email addresses, SSNs, medical record numbers, plan beneficiary numbers, account numbers, license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full face photos, and any other unique identifier.

Two things surprise owners. First, dates and ZIP codes count. A dataset with no names but exact admission dates and five digit ZIP codes is still PHI. Second, the same field changes status with context. An email address in a newsletter list is just an email address. The same address in a list of patients at your oncology practice is PHI.

Web tracking deserves its own warning. In June 2024 a Texas federal court vacated the part of OCR’s guidance that treated an IP address plus a visit to an unauthenticated public page as PHI, and HIPAA Journal reports OCR then dropped its appeal. Do not read that as a green light. As Holland & Hart points out, HIPAA still applies when health information is collected alongside identifying data, such as an appointment form or a login. The pixel on your booking page is still your problem.

Where PHI Hides in an AWS Account

Most teams scan the database and the obvious buckets. PHI leaks through the plumbing.

The AWS News Blog describes Amazon Macie as a service that finds sensitive data with machine learning and pattern matching, with automated discovery on by default for new customers. Good tool. One limit: Macie reads S3. It does not read your logs or queues.

For logs, AWS documents data protection policies that mask matching data at every egress point, including Logs Insights, metric filters, and subscription filters, and only principals with the logs:Unmask permission see the original values. The managed identifiers cover items like health insurance and medical identification numbers. Treat this as a net, not a plan. Pattern detection will not reliably catch a patient’s name inside a free text error message. The fix for the Friday Lambda is to stop logging the body.

The BAA Covers Services, Not Your Design

You accept the AWS Business Associate Addendum through AWS Artifact. In a multi account setup, accounting guidance from AccountableHQ says to accept it at the Organizations management account and track acceptance centrally. Do it before any PHI lands anywhere, not after the first sprint.

Then check the AWS HIPAA Eligible Services Reference, which showed a last updated date of September 3, 2026 when I pulled it. Over 100 services are listed, and generally available features of listed services are covered unless the page says otherwise. Preview features are the usual trap.

AWS also states that you may use services not on the list, even inside a HIPAA account, provided they do not process or store ePHI. That detail changes how you design. The boundary is the data flow, not the account. A non eligible service sitting beside your PHI is fine. The same service receiving a PHI payload through an EventBridge rule is a violation. And the same page is blunt that customers remain responsible for their own HIPAA compliance, so eligible never means compliant.

Handling It: Five Controls in the Order They Fail

AWS data security for healthcare works as a pipeline. Each control below covers the gap the previous one leaves.

1. Classify at the door. Tag every bucket, table, and queue that can hold PHI with a data classification tag, and turn on Macie automated discovery across the organization. If a new bucket appears without a tag, that is an alert, not a cleanup task.

2. Encrypt with keys you control. Use customer managed KMS keys, one per data domain, so a key policy change can cut off one workload without touching another. The current Security Rule treats encryption as addressable. The 2025 proposal would make it mandatory, but Fierce Healthcare reports the Unified Agenda now lists final action for July 2027. Do not wait. Clearwater’s 2026 analysis notes the existing rule is live and enforced, and OCR expects encryption already. Also remember encryption at rest does nothing when your application decrypts a record and writes it to a log. The log is where you lose.

3. Close the log leak. Apply data protection policies to every log group in PHI accounts, alarm on the LogEventsWithFindingsmetric, and review who holds logs:Unmask.

4. Tie access to tags and record it. Write IAM conditions against your classification tags. Enable CloudTrail data events on PHI buckets, because object level reads are not recorded unless you turn that on. When OCR or a customer asks who opened a file, this is the evidence.

5. Deidentify before analytics. Data scientists rarely need identities. HIPAA gives you two routes: Safe Harbor (strip the 18 identifiers) or Expert Determination (a qualified statistician documents that reidentification risk is very small). Once data is properly deidentified it leaves the Privacy Rule, per Hobbs Straus. A limited data set keeps dates and geography but requires a data use agreement. One counterintuitive trap from the HHS guidance, as summarized by Davis Wright Tremaine: Safe Harbor fails if you have actual knowledge that what remains could identify someone, for example a row carrying a unique job title. Stripping the 18 fields is necessary, not sufficient. Amazon Comprehend Medical offers a PHI detection API for this work; confirm its eligibility on the reference page before use.

What a Miss Costs

For penalties assessed on or after January 28, 2026, civil exposure reaches $2,190,294 per violation category per calendar year, according to Prospyr’s summary of the HHS adjustment. Bacancy Technology adds that OCR can count violations per affected individual or per day non compliance continues, which is how a single unmasked log group becomes a large number.

The more useful signal is what investigators ask. A 2026 review of four OCR ransomware settlements on compliancehub.wiki points to risk analysis failures as the common thread. Risk analysis means you can show where PHI lives and how it moves. If you cannot draw that data flow, you cannot defend it.

A Two Hour Audit Before Your Next Release

1. List every log group in PHI accounts and check for a policy: aws logs get-data-protection-policy --log-group-identifier <name>.
2. Confirm Macie is on in every region you use, and review the bucket heat map for untagged buckets holding sensitive data.
3. Grep your codebase for logging statements that print request bodies, exception payloads, or serialized objects.
4. Compare every service in your architecture diagram against the HIPAA Eligible Services Reference, and mark any non eligible service that receives events from PHI sources.
5. Search dev and staging for production snapshots. Delete them and replace them with synthetic data.

Do these five and you will know more about your own PHI than most auditors will ask.