HIPAA Compliance Services & HIPAA Compliance Consulting

The HIPAA Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards that protect electronic protected health information. The technical safeguards are where most cloud-native organizations have the largest gaps: access controls, audit controls, integrity controls, authentication, and transmission security are all required and must be implemented, not just described in a policy.

Access controls require that only authorized users can access systems containing PHI, at the level of access their role requires. In a cloud environment this means IAM policies that enforce least privilege, role-based access with documented justification, and access reviews that confirm current users still need the access they have. An access control policy that describes these requirements but lives above an AWS environment where developers have administrator-level permissions is not a passing control.

Audit controls require systems that record and examine activity in systems containing PHI. CloudTrail must be enabled across all regions and accounts touching PHI, with integrity controls that prevent log tampering, retention configurations that satisfy minimum periods, and a review process that produces documented evidence. Most organizations have CloudTrail enabled. Few have it configured to produce audit evidence that satisfies an OCR examiner.

A HIPAA attestation letter is only as credible as the assessment behind it. Letters produced from policy reviews and staff interviews are common and largely worthless under examination. When OCR investigates a breach or an enterprise customer conducts security due diligence, they will ask for evidence that specific controls are implemented. An attestation backed by documentation review cannot produce that evidence.

Access gets checked against who actually has it in IAM, not who the policy says should. Logging gets checked for whether CloudTrail is actually capturing and retaining what OCR would expect, not whether it's turned on. And encryption gets checked bucket by bucket, resource by resource, rather than taken on the word of a policy that says PHI is protected.

The result is an attestation letter backed by infrastructure evidence that answers the questions an examiner actually asks. We also deliver the evidence package alongside the letter, so your team has documentation it can produce on demand without reconstructing the assessment from scratch.