HIPAA compliance affects how the system is designed
The regulation's security rule sets requirements for protecting electronic protected health information, and those requirements translate directly into design decisions about how a cloud platform is built.
What the design needs to cover
Encryption
Protected health information is encrypted in transit between every component, not just at the edge, and at rest in every store that holds it — including backups and logs.
Access control
Every access to PHI is authenticated, authorized against the minimum necessary principle, and logged. Least privilege applies to people and to services. Role based access with regular review is the baseline.
Audit trails
Who accessed what, when, and what they did with it — retained and tamper evident. Both a regulatory requirement and the first thing an investigation needs after an incident.
Network segmentation
Systems that hold PHI are isolated from those that do not, with controlled paths between them. A public web tier does not sit on the same network as the database.
Backup and recovery
PHI has to survive failures. Tested backups, defined recovery objectives, and disaster recovery that has actually been rehearsed.
The business associate agreement
The cloud provider handling PHI signs a BAA, and only the provider's services covered under that agreement are used for PHI. On AWS and the other major clouds that is a defined list, and using a service outside it with PHI is a violation regardless of how it is configured.
Migration without downtime
Moving a live healthcare system to a compliant cloud environment takes careful planning. Clinical operations cannot stop, so the migration runs in parallel, with data synchronized between old and new, integrations tested against the new environment while the old one still serves, and a cutover planned to the minute with a rollback path ready.
Multi site systems add the complexity of coordinating across facilities that may be on different schedules and different legacy systems.
SequoiaAT built a HIPAA compliant AWS environment for a multi site hospital network, supporting real time HL7 FHIR R4 data exchange across all facilities, and completed the migration with zero downtime during cutover.