Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service.

Is it enough to partition these services into different security groups and restrict inbound traffic only to the calling service? Would this type of authentication be HIPAA compliant?

share|improve this question
I can't comment on the HIPAA bit but your issue would be a lack of defense-in-depth. It would be relatively easy to accidentally alter the rules in the future inadvertently exposing the interface to an untrusted system or network (i.e. it's not fail-safe). –  Andy Boura Aug 7 at 9:56

1 Answer 1

You can have multiple API keys. It's in the basic service offering. You can audit their usage and restrict by originating IP and other factors.


It may be that you need to use the AWS identity product; http://aws.amazon.com/iam/

Amazon has published a whitepaper on HIPAA and HITECH measures for AWS


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.