Building Telehealth Infrastructure on AWS

Two services in the standard AWS telehealth reference architecture lost support in 2026. AWS ended support for the Amazon Chime application on February 20, 2026. It ends support for Amazon Pinpoint, the service AWS’s telehealth solution page names for SMS appointment reminders, on October 30, 2026. A well-built platform survives both events. A platform copied from a 2022 tutorial does not.

That gap, between a diagram that works and an architecture you can defend to an auditor, is where most telehealth builds get into trouble. If you run a health company and you want HIPAA-compliant telehealth on AWS, you need to know one thing before anything else: the video call is the easiest part to secure. In practice, telehealth data security fails in the metadata, logs, reminders, recordings, and third-party scripts that surround the call.

This article walks through the layers of a telehealth platform, what each one exposes, and the decisions your CTO should lock before the first sprint.

Eight Layers, Eight Ways to Leak PHI

Before you pick services, map where protected health information (PHI) can appear. In a telehealth platform it appears in more places than the video stream.

Every service in that table can be used under the AWS Business Associate Addendum. That fact is necessary and nowhere near sufficient. AWS maintains a HIPAA Eligible Services list, last updated September 3, 2026, and it covers the building blocks above, including both the Amazon Chime SDK and AWS HealthScribe. Eligibility means AWS will sign a BAA for that service. It says nothing about whether your code puts a patient’s name in a log line.

Which Chime You Mean, and Whether You Need It at All

Teams still confuse two products. The Amazon Chime application was a meeting tool, and AWS ended support for it on February 20, 2026. The Amazon Chime SDK is a set of builder tools for adding audio, video, and messaging to your own app. AWS’s own documentation states that the end of support does not affect the Chime SDK. The SDK works independently of any Chime administrator account.

If you read an older guide that tells you to provision Chime accounts for clinicians, stop reading it.

Your real video decision has four branches.

Be honest about build versus buy. Fora Soft, a telemedicine development firm that sells custom builds, puts a HIPAA telehealth SaaS with a signed BAA at roughly $19 to $25 per provider per month for a clinic. The same firm argues that custom development pays off above about 10,000 monthly active users, with deep EHR integration, white-label patient apps, or workflows templates cannot model. Treat that as a vendor’s view, then apply the rule I use myself: build when telehealth is the product you sell, buy when it is a feature of clinical operations.

The Call Is Encrypted. Everything Around It Is Where You Leak PHI

AWS documents that Chime meetings use AES-based encryption for media. You do not need to engineer that part. You need to engineer the parts that surround it.

Meeting and attendee identifiers

The CreateMeeting and CreateAttendee calls accept external identifiers, and those values travel through your logs, CloudTrail, and event streams. Use opaque UUIDs mapped to visits in your own database. A meeting called jane-doe-oncology-follow-up is a disclosure waiting for a log export.

Event streams

The Chime SDK integrates with Amazon EventBridge, and AWS notes you can use it to detect suspicious activity and end a call. Use that. Route meeting events to a security account, and keep patient identifiers out of the payloads you forward.

Join links

A link that works for anyone holding it is a shared password. Issue single-use tokens that expire, bind them to an authenticated patient session, and put a waiting room between the patient and the clinician. Keep tokens out of URL paths, because CloudFront and ALB access logs record them.

Browser scripts

This one catches healthcare companies that have excellent AWS hygiene. OCR’s tracking technology guidance, partly vacated by a federal court as it applied to IP addresses on unauthenticated pages, still applies to authenticated pages such as patient portals and visit waiting rooms, according to Accountable HQ’s 2025 summary. A marketing pixel on the waiting room page is a PHI disclosure to an advertising vendor. Strip every third-party script from authenticated routes, and enforce it with a Content Security Policy.

Recordings Create the Longest-Lived PHI You Own

Chime SDK media capture pipelines write audio, video, content shares, chat data, and meeting events to an S3 bucket. The bucket must belong to the same AWS account as the meeting. AWS’s documentation also states that recording may be subject to consent laws, so build the consent step into the product, not into a policy PDF.

Encryption takes one specific piece of configuration that teams miss. To use S3 server-side encryption with a customer managed KMS key, the key policy must allow the service principal mediapipelines.chime.amazonaws.com to call kms:GenerateDataKey, scoped to your account. If you run media concatenation pipelines, the same principal needs kms:Decrypt. Skip that statement and the pipeline fails at the exact moment a clinician hits record.

Here is the counterintuitive part: not recording is a security control. A recording is ePHI with the longest life of anything in your stack. It lands in discovery requests, breach scope calculations, and access requests. Patient Protect’s 2026 review of telehealth enforcement lists session recording storage among the top exposures it sees. Decide per visit type whether you record at all, and default to off.

When you do record, treat the bucket like a clinical database.

• Give it a dedicated KMS key, separate from your application data key.
• Enable CloudTrail data events on the bucket. Management events alone will not show who read a recording.
• Set a lifecycle rule tied to a written retention decision. HIPAA requires you to keep compliance documentation for six years, and state medical record rules often run longer, so involve counsel before you pick a number.
• Restrict read access to a break-glass role, not to every engineer with console access.

For clinical notes, AWS HealthScribe turns visit audio into transcripts and draft notes. AWS states it does not use customer inputs or outputs to train the service, and each generated summary sentence links back to the source transcript. AWS positions it in an assistive role. Your product should too: clinicians review and sign every note.

Appointment Reminders: Replace Pinpoint Now and Strip the PHI While You Are There

Amazon Pinpoint stopped accepting new customers on May 20, 2025, and AWS ends support on October 30, 2026. After that date, endpoints, segments, campaigns, journeys, and analytics become inaccessible. The SMS, voice, and push channel APIs continue under the name AWS End User Messaging, which AWS renamed in Q3 2024.

AWS’s migration guide points engagement features toward Amazon Connect, and it lists gaps there: in-app messaging, push notifications within campaigns, custom channels, imported segments, and journeys. If your reminder flow used Journeys for no-show follow-ups, you are rebuilding logic, not changing an endpoint. Carrier registration for SMS sender IDs also moves at carrier speed, so start it early.

Use the migration to fix the content of the messages. Compare two reminders:

A specialty is a diagnosis hint. Send the minimum, and move detail behind authentication.

Identity Choices Auditors Read First

Auditors open with identity because it is fast to check and slow to fake.

Staff

Require MFA for every clinician, support agent, and engineer. Use IAM Identity Center for AWS access, with no long-lived access keys on laptops. Cognito handles application users, including MFA enforcement for clinicians.

Patients

Patients will abandon a visit flow with friction, so MFA for them needs thought. Use passwordless email or SMS codes for step-up at sign-in, short sessions during a visit, and re-authentication before downloading anything.

Break-glass access

Create one audited role for emergency access to production data. Alarm on every assumption of it. If no one has assumed it in a quarter, that tells you the process works.

One AWS Account Is the Most Expensive Shortcut

A single account is fast on day one. It becomes a migration project the day an enterprise buyer asks how production PHI is isolated.

Use AWS Organizations with separate accounts for production PHI, non-production, log archive, and security tooling. Attach service control policies that deny disabling CloudTrail, deny unapproved Regions, and require encryption on storage. Run the AWS Config HIPAA conformance pack that AWS publishes, and send findings from GuardDuty, Inspector, and Macie into Security Hub so your team reviews one queue during an incident, not four consoles.

Two practical rules save money and trouble:

• Staging gets synthetic data only. Real patient data in a test environment is a breach waiting for a misconfigured bucket.
• Scrub logs at the source. CloudWatch Logs data protection policies can mask sensitive patterns, but the cleaner fix is never logging request bodies on visit endpoints.

Third-party tools need the same scrutiny. Error trackers, session replay tools, and customer support widgets all collect payloads. Each one needs a BAA or a configuration that guarantees no PHI reaches it.

The Security Rule Is Still a Proposal. Build to It Anyway

The HHS Office for Civil Rights published its proposed overhaul of the HIPAA Security Rule on January 6, 2025, and the comment period closed March 7, 2025. As of mid 2026, trackers such as Medcurity reported that no final rule had been issued, despite a May 2026 target on the regulatory agenda. One tracker cited a later target of July 2027. Check the Federal Register before you plan around any date.

The proposal would make several controls mandatory instead of addressable:

Medcurity reports a 240 day compliance window once a final rule publishes. Do not read that as time to wait. Deferring telehealth data security gets expensive: on AWS, encryption and MFA are configuration choices today and migration projects later. The item that surprises telehealth teams is not encryption. It is the asset inventory and business associate verification, because a telehealth stack accumulates vendors fast: video, SMS, email, payments, analytics, support.

Separately, the COVID-era OCR enforcement discretion for telehealth ended on May 11, 2023, with a 90 day transition that closed August 9, 2023. Any telehealth platform running today answers to the full rule set.

Mistakes That Show Up in Almost Every Telehealth Review

1. Treating the BAA as the finish line. AWS’s BAA covers AWS’s side of the shared responsibility model. Your IAM policies, logging, and application code are yours.
2. Logging request bodies in production. It starts as debugging help. It ends as PHI in CloudWatch, copied to your observability vendor.
3. Putting identifiers in meeting names. Opaque IDs cost nothing. Descriptive names cost an incident.
4. Enabling CloudTrail and stopping there. Without S3 data events, you cannot show who opened a recording.
5. Running real data in staging. The weakest environment becomes the breach.
6. Following an old reference architecture without checking service status. Chime application and Pinpoint prove that reference diagrams age faster than the services they depict.

Decisions to Lock Before the First Sprint

Your CTO should walk into sprint one with these answered in writing.

If you can answer all eight, you have a defensible foundation for HIPAA-compliant telehealth on AWS. If you cannot, the gaps tell you where your first month of engineering goes.