AWS Releases HIPAA Security Rule Technical Safeguards Implementation and Readiness Guidance

New HIPAA Compliance Guidance from AWS

AWS has published "HIPAA Security Rule on AWS: Technical Safeguards Implementation and Readiness Guidance." This document assists covered entities and business associates in configuring, implementing, and demonstrating compliance with the HIPAA Security Rule Technical Safeguard requirements (45 CFR §164.312) for healthcare workloads on AWS.

Addressing Current and Proposed Regulations

The guidance details the five standards and nine implementation specifications of the HIPAA Security Rule’s Technical Safeguards, which include access control, audit controls, integrity, authentication, and transmission security. It also incorporates proposed changes from the 2025 Notice of Proposed Rulemaking (NPRM), such as mandatory encryption at rest and in transit, multi-factor authentication for all ePHI access, and new specifications for network segmentation, configuration management, anti-malware protection, and incident response.

Key Topics Covered

The guidance includes a shared responsibility matrix that maps each §164.312 specification to responsibilities managed by AWS and those requiring customer configuration. It also provides recommendations for establishing a defined ePHI boundary, a reference architecture for tracing ePHI data flow with applicable specifications, and a foundational checklist of prerequisites before configuring individual Technical Safeguard controls.

Target Audience and Scope

This resource is intended for cloud architects, security engineers, CISOs, and compliance teams working with AWS healthcare workloads. It assumes familiarity with AWS services and serves as a practical implementation reference, not a legal or regulatory interpretation. The guidance focuses exclusively on Technical Safeguards and recommends treating all specifications as required for new workloads, anticipating future regulatory updates.