HealthTech Starter Kit: HIPAA

For telehealth companies, EHR vendors, health data platforms, and any company about to handle Protected Health Information (PHI) for the first time. The infrastructure decisions that cost weeks to retrofit later (RDS encryption at creation, S3 Object Lock for retention, PHI network isolation) are built in from the start.

GitHub: compliancetf/starter-kit-healthtech-hipaa

Registry: hipaa.compliance.tf

Resources deployed: approximately 140

Architecture

PHI data stores are isolated in private subnets with no public routes. The API Gateway and ALB handle authorized ingress. EKS and Lambda process PHI within the VPC. OpenSearch provides audit log search and retention. S3 Object Lock enforces the PHI retention period.

Quick Start

Prerequisites: Terraform >= 1.3, AWS credentials, a compliance.tf account, a Route 53 hosted zone, and an S3 replication IAM role + destination bucket (required for §164.308(a)(7)(ii)(A) data backup). See Create the replication prerequisites if you do not have those yet.

git clone https://github.com/compliancetf/starter-kit-healthtech-hipaa.git
cd starter-kit-healthtech-hipaa

cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars: set project_name, domain_name, route53_zone_id,
# availability_zones, s3_replication_role_arn, s3_replication_destination_bucket_arn

terraform login hipaa.compliance.tf

terraform init
terraform plan
terraform apply

terraform plan fails if any HIPAA control is violated. The error names the specific control and the module that triggered it. Fix the issue and re-run.

Module Inventory

HIPAA Security Rule Coverage

PHI Retention Configuration

phi_retention_years = 7  # adjust to match your jurisdiction

HIPAA-Eligible AWS Services

All services in this kit are on the AWS HIPAA-eligible services list. Before adding any service to your architecture, confirm it is on that list.

Business Associate Agreements (BAAs)

compliance.tf does not manage BAAs. You are responsible for:

• Signing an AWS BAA before any PHI touches AWS infrastructure (done in the AWS Artifact console)
• BAAs with any third-party vendor that receives or processes PHI (analytics, monitoring, CDN, support tooling)
• BAAs with subcontractors who have access to systems that handle PHI

The AWS BAA covers the services in this kit at the infrastructure level. Application-level PHI handling, access controls, and workforce training are your responsibility under the HIPAA Privacy Rule and administrative safeguards.

What compliance.tf Covers vs. What You Own

What this kit handles

• KMS encryption at rest for all PHI data stores (pass your own key ARNs for customer-managed keys)
• S3 Object Lock for PHI record immutability during the retention period
• Cross-region replication on the PHI bucket and the logs bucket
• TLS 1.2+ on all endpoints, enforced at ALB and within cluster networking
• PHI network isolation; data stores have no public routes
• IAM authentication required for RDS, Aurora, DynamoDB, and OpenSearch
• API Gateway access logging and VPC flow logs for all PHI network traffic
• Multi-AZ Aurora and ElastiCache failover; 7-day minimum backup retention (14 days in prod)
• Deletion protection on databases and ALB in environment = "prod"

What you own

• Business Associate Agreements with AWS and every third-party vendor that touches PHI
• Application-level PHI access controls and audit logging at the field level
• Security awareness training (§164.308(a)(5)) and information access management (§164.308(a)(4))
• Security incident response procedures (§164.308(a)(6))
• Breach notification to affected individuals, HHS, and media when required (45 CFR §164.400-414)
• Risk analysis and risk management (§164.308(a)(1)(ii)(A)-(B))
• Physical device safeguards for workstations and portable media
• Privacy Rule compliance and patient rights management

compliance.tf covers the technical safeguards of the HIPAA Security Rule. A HIPAA privacy officer still needs to handle the administrative safeguards and the Privacy Rule.

Common Customizations

Disable a specific control

If a control does not apply to your use case, disable it with a query parameter on the module source. Query parameters require the HTTPS URL format (the Registry format does not support them):

module "dynamodb" {
  source = "https://hipaa.compliance.tf/terraform-aws-modules/dynamodb-table/aws?version=5.0.0&disable=dynamodb_table_auto_scaling_enabled"
  # ...
}

That example turns off the DynamoDB auto scaling control, which applies to provisioned-capacity tables; the kit's table uses PAY_PER_REQUEST, where there is no provisioned capacity to scale. Do not use this to switch off an encryption, Object Lock, or audit logging control on a module that touches PHI — those map to Security Rule safeguards, and an auditor will ask why the control is absent.

Control identifiers are listed in the controls catalog; see Customize modules for the full enable/disable interface.

Cost Estimate

Next Steps

• HIPAA Framework Reference: full control list per requirement
• Audit Evidence Guide: how to prepare infrastructure evidence for HIPAA audits
• Brownfield Migration Kit: if you have existing Terraform to migrate rather than starting fresh
• Version Compatibility Matrix: supported module versions