Healthcare Compliance in the Cloud
Build applications that store, process, and transmit sensitive health-related information, consistent with your privacy and security obligations.
Health and Social Care Cloud Security – Good Practice Guide
At AWS, security and privacy is the top priority
Roles and Responsibilities
Your data, stored in AWS, is your data. Our shared security model ensures ownership and control of your data remains with you at all times. We offer a robust set of solutions to keep healthcare data protected and readily available. AWS provides access to more than 130 HIPAA eligible services as well as numerous certifications for industry-relevant global IT and compliance standards, including support for GDPR, HITRUST, ENS High, HDS, and C5. And, with twice as many Availability Zones as any other cloud provider, health organizations can benefit from the scale, security, and reliability of AWS.
AWS & Data Privacy
AWS takes data privacy very seriously, and maintaining customer trust is an ongoing commitment. Customers always manage access to their services and content. We do not access or use customer content for any purpose without the customer’s consent. Customers choose the region(s) in which their customer content will be stored. We will not move or replicate customer content outside of the customer’s chosen region(s) without the customer’s consent.
Learn more »
Shared Responsibility
Understanding how to build healthcare applications on AWS means understanding the shared responsibility model. In the AWS Cloud, security is shared between AWS and the customer. This means that certain elements of security (such as physical security of the underlying infrastructure) are now the responsibility of AWS. Customers are still responsible for other aspects of security (such as the security measures used to protect your applications), which is no different than if your application was running in a traditional data center.
Learn more »
AWS Healthcare Compliance Alignments / Frameworks
AWS Compliance Certifications:
The AWS compliance certifications demonstrate the “security of the cloud” and the operating effectiveness of AWS controls. Customers are responsible for the security in the cloud.
Customers inherit these compliance certifications and can use them to demonstrate part of their compliance to auditor and regulators.
Certifications / Attestations:
Compliance certifications and attestations are assessed by a third-party, independent auditor and result in a certification, audit report, or attestation of compliance.
Laws / Regulations / Privacy:
AWS customers remain responsible for complying with applicable compliance laws and regulations. In some cases, AWS offers functionality (such as security features), enablers, and legal agreements (such as the AWS Data Processing Agreement and Business Associate Addendum) to support customer compliance.
No formal certification is available to (or distributable by) a cloud service provider within these law and regulatory domains.
Compliance alignments and frameworks include published security or compliance requirements for a specific purpose, such as a specific industry or function. AWS provides functionality (such as security features) and enablers (including compliance playbooks, mapping documents, and whitepapers) for these types of programs.
It is important to mention the shared responsibility model while discussing regulatory compliance. AWS bring in state of the art technologies, goes through the industry standard certifications and attestations both globally and regionally where possible and align to industry frameworks to help facilitate the compliant implementation of AWS services for healthcare compliance. Under the aegis of shared responsibility model, customers can inherit the compliant controls and capabilities to meet the needs of healthcare compliance in that region.
