HealthTech - HIPAA

For a telehealth company, EHR vendor, health data platform or any team about to handle protected health information (PHI) for the first time. The kit deploys from the hipaa.compliance.tf registry host and builds in the decisions that take weeks to retrofit: RDS encryption at creation, S3 Object Lock for retention and PHI network isolation. When you finish, the stack is applied and every HIPAA control its modules enforce has passed terraform plan.

Repository: compliancetf/starter-kit-healthtech-hipaa · About 140 resources

Before you start

• The shared prerequisites on Compliance starter kits: an account whose plan includes HIPAA, Terraform at a version every module accepts, AWS credentials, a Route 53 hosted zone, the replication role and destination bucket, and account-level CloudTrail. The replication pair supports the §164.308(a)(7)(ii)(A) data backup plan, and §164.312(b) audit controls expect the CloudTrail trail alongside the resource logs this kit configures.
• A signed AWS Business Associate Agreement (BAA), from the AWS Artifact console, before any PHI reaches the account. See Business associate agreements.
• Leave RDS encryption on. storage_encrypted = true has to be set when the database is first created; AWS cannot encrypt an existing instance without a snapshot and restore to a new one, which means migrating data, changing connection strings and rebuilding what depends on it. The kit enforces encryption by default.
• Decide on one database. The kit provisions a standard RDS PostgreSQL instance and an Aurora PostgreSQL cluster; most teams need one. Delete the module block you do not use, and its output in outputs.tf, before the first apply.

Deploy

git clone https://github.com/compliancetf/starter-kit-healthtech-hipaa.git
cd starter-kit-healthtech-hipaa

cp terraform.tfvars.example terraform.tfvars
# Set project_name, domain_name, route53_zone_id, availability_zones,
# s3_replication_role_arn and s3_replication_destination_bucket_arn

terraform login hipaa.compliance.tf

terraform init
terraform plan
terraform apply

If a value in terraform.tfvars breaks a HIPAA control, terraform plan fails with an error that names the control and the module. Fix the value and plan again.

What it deploys

PHI data stores sit in private subnets with no public routes. API Gateway and the ALB take authorized ingress. EKS and Lambda process PHI inside the VPC. OpenSearch holds audit logs for search and retention. S3 Object Lock holds PHI for the retention period.

Aurora (a writer and a reader) is the primary PHI store. The standard instance is sized for lower-tier PHI at roughly a seventh of the cost; compare the two rows under Cost. Neither module references the other.

Control coverage

Settings that a module enforces as a control fail the plan if you change them. The rest are kit defaults you can change. The HIPAA framework page lists the controls modules enforce and the mapped-only controls that stay with your team.

What you own

The kit configures the infrastructure settings above. These stay with you and your privacy officer:

• Business Associate Agreements with AWS and every third-party vendor that touches PHI
• Application-level PHI access controls and audit logging at the field level
• Security awareness training (§164.308(a)(5)) and information access management (§164.308(a)(4))
• Security incident response procedures (§164.308(a)(6))
• Breach notification to affected individuals, HHS, and media when required (45 CFR §164.400-414)
• Risk analysis and risk management (§164.308(a)(1)(ii)(A)-(B))
• Physical device safeguards for workstations and portable media
• Privacy Rule compliance and patient rights management

PHI retention

HIPAA's 6-year retention requirement (45 CFR §164.316(b)(2)(i)) applies to Security Rule documentation (policies, procedures, risk analyses), not to clinical PHI records. State law sets clinical record retention: most states require 5 to 10 years, and some longer for pediatric records.

The kit defaults to 7 years, which covers the federal documentation minimum and most state requirements. Set it in terraform.tfvars:

phi_retention_years = 7  # adjust to match your jurisdiction

The s3_bucket_phi module holds objects with S3 Object Lock in GOVERNANCE mode: an object cannot be deleted before its retention period ends unless the caller has s3:BypassGovernanceRetention. COMPLIANCE mode, set in main.tf, locks out the AWS root user too, with no override; use it only when you are certain of the retention period.

HIPAA-eligible AWS services

Every service in the kit is on the AWS HIPAA-eligible services list. Only services covered by the AWS BAA may store or process PHI, and the list changes, so check it before adding a service. PHI routed through an ineligible service falls outside the BAA.

Business associate agreements

Compliance.tf does not manage BAAs. You are responsible for:

• Signing an AWS BAA before any PHI touches AWS infrastructure (done in the AWS Artifact console)
• BAAs with any third-party vendor that receives or processes PHI (analytics, monitoring, CDN, support tooling)
• BAAs with subcontractors who have access to systems that handle PHI

The AWS BAA covers the services in this kit at the infrastructure level. Application-level PHI handling, access controls, and workforce training are your responsibility under the HIPAA Privacy Rule and administrative safeguards.

Customize

Turn off a control

Use the HTTPS source with ?disable=:

module "example" {
  source = "https://hipaa.compliance.tf/terraform-aws-modules/<module>/aws?version=<version>&disable=<control_id>"
  # ...
}

Two things decide whether this does anything:

• Only a control the module enforces can be turned off. Disabling a control the framework maps but the module does not enforce does nothing, and nothing tells you so. Each control page says whether it is enforced.
• Inside the PHI boundary, leave them on. Do not turn off an encryption, Object Lock, backup or audit logging control on a module that stores or processes PHI. An auditor will ask why it is absent, and "it did not apply to our use case" does not survive the question. The parameter is for modules outside the PHI boundary, such as a cost or observability setting on a workload that stores no patient data.

Turn controls on and off explains the limits and how to record the reason.

Adjust sizes or remove a module

Instance sizes and counts are variables; override them in terraform.tfvars, with the names in the repository's variables.tf. To drop a module the application does not use, delete its block from main.tf and its outputs from outputs.tf, then check that no other module references it.

Cost

The total is the sum of the rows above, with both databases; deleting one of them lowers it. The table has no rows for API Gateway, WAF, DynamoDB, KMS or CloudWatch Logs, so add those. Usage charges come on top: data transfer, NAT gateway data processing, log ingestion, and KMS and WAF requests. Actual costs depend on usage, data transfer and region. Infracost estimates them from your own terraform plan.

Next steps

• Audit evidence
• HIPAA framework page
• Turn controls on and off
• Migration kit