HIPAA Compliance
TL;DR / Key Takeaways
- •ConnectHealth runs entirely within your AWS VPC — your PHI never leaves your environment.
- •HIPAA-compliant architecture out of the box with encryption at rest and in transit.
- •Business Associate Agreement (BAA) available for Enterprise customers.
- •Automated 6-year audit trail via CloudWatch — no manual log retention to manage.
- •Shared responsibility model: ConnectHealth handles application security, you control networking.
ConnectHealth is designed from the ground up to operate securely in regulated healthcare environments. We provide the tools, architecture, and documentation required to meet HIPAA, HITECH, and SOC 2 standards without sacrificing developer experience.
1. Business Associate Agreement (BAA)
Under the Health Insurance Portability and Accountability Act (HIPAA), a Business Associate Agreement is required when a vendor handles Protected Health Information (PHI) on your behalf.
Because ConnectHealth deploys entirely within your AWS environment, we (ConnectHealth, the vendor) do not host, store, or transit your PHI on our infrastructure. All data processing occurs in your Customer VPC.
However, for Enterprise customers receiving managed support, ConnectHealth signs a standard BAA that covers our responsibilities during incident response, remote troubleshooting, and professional services engagements. You also maintain a direct BAA with AWS for the underlying infrastructure (EC2, ECS, KMS, RDS, etc.).
How to Accept the AWS BAA
Before pulling PHI into your AWS account, you must electronically accept the AWS Business Associate Addendum.
- Sign in to the AWS Artifact Console using an administrator account.
- Navigate to the Agreements tab on the left sidebar.
- Locate the AWS Business Associate Addendum (BAA) agreement.
- Review the terms, confirm your legal entity information, and click Accept agreement.
Note: If you are using AWS Organizations, you can accept the BAA on the management account to cover all current and future member accounts.
2. Administrative Safeguards
Administrative safeguards manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
Auditing & Monitoring
ConnectHealth produces detailed "Access Events." This specialized audit trail satisfies HIPAA requirements for monitoring access to PHI. It tracks who accessed the system, what FHIR resources were requested, and the transaction's outcome.
3. Physical Safeguards
ConnectHealth inherits the robust physical safeguards of Amazon Web Services. AWS data centers feature state-of-the-art physical security, environmental controls, and redundant utility systems. AWS holds SOC 1, SOC 2, SOC 3, and ISO 27001 certifications. Customer-controlled AWS Region selection guarantees physical data residency.
4. Technical Safeguards
Technical safeguards are the technology policies and procedures that protect ePHI and control access to it. ConnectHealth provides the following technical controls out-of-the-box:
Access Controls
- OAuth 2.0 & SMART on FHIR: ConnectHealth handles all the complexity of securely managing EHR tokens, including JSON Web Token (JWT) signing and automated refresh cycles.
- API Keys: Stored in AWS Secrets Manager, injected only at runtime within isolated container environments.
Audit Logs (6-Year Retention)
- Detailed access logs track every successful and failed EHR interaction.
- Logs are shipped to AWS CloudWatch Log Groups, which can be configured for immutable storage (WORM) and a minimum 6-year retention policy.
- Crucially: Detailed PHI payloads are automatically redacted from application logs to prevent accidental exposure of PHI to your IT staff reading CloudWatch.
Encryption
- In-Transit: TLS 1.2+ for all external traffic.
- At-Rest: Customer-Managed AWS KMS Keys applied to all persistent storage (RDS) and temporary file processing volumes (EFS).
5. Shared Responsibility: Customer Best Practices
While ConnectHealth provides the foundational architecture for HIPAA compliance, security in the cloud is a shared responsibility. Because ConnectHealth deploys into your VPC, you hold the keys to its security groups and networking configuration.
To ensure your environment remains compliant, we strongly recommend the following best practices when launching the infrastructure:
1. IP Whitelisting (Security Groups & WAF)
Restrict access to the ConnectHealth API and Dashboard exclusively to your corporate IT networks or specific trusted partner endpoints. This is done by configuring inbound rules on your Application Load Balancer (ALB) Security Groups, and can be further enhanced using AWS Web Application Firewall (WAF) for Layer 7 filtering.
2. Secure Network Access
For internal administrative access, do not expose the console to the public internet. Access the dashboard via an AWS Client VPN or AWS Direct Connect bound to your VPC.
3. Least-Privilege IAM
Ensure that the IAM Users or Roles you create to deploy the CloudFormation templates adhere strictly to the principle of least privilege required for deployment.
4. Alert Monitoring
Configure AWS SNS topics to page your security operations team if CloudTrail detects unexpected IAM policy changes or security group modifications within the ConnectHealth VPC.
What's Next?
- Security Architecture — Deep-dive into our Zero-Trust Network and AI Guardrails
- Quickstart Guide — Launch your first secure integration in 15 minutes
- Workflow Builder — Understand how data flows between EHRs visually