1

Amazon HIPAA compliance requires customers to run on dedicated hardware (https://aws.amazon.com/compliance/hipaa-compliance/).

I would think isolation of the operating system and encryption of data at rest and data in transit would be enough.

What are the risks of sharing hardware with other client virtual machines? I am trying to understand the reasons behind their decision for this restriction.

2

Not using dedicated hardware can lead to information leakage due to shared caches, compromised hypervisors (due to various timing-based side channels, and other issues due to uncertain performance stability.

Encryption of the data at rest and in transit is not sufficient as several of these attacks have demonstrated proof-of-concepts that steal keys from neighbours. In general, compliance regulations tend to err on the side of caution until a technology is mature.

0

Although you may be correct with respect to your assessment of the technical safeguards you describe being adequate (though I would trust AWS risk managers and other answers demonstrate some possible technical concerns), it is largely irrelevant.

You are required under HIPAA to secure Business Associate Agreements with any technology vendors with whom you share PHI or use their platforms to transmit, store, or process PHI.

AWS will only sign a BAA with a company if they use dedicated hardware so if you want to comply with the BAA mandate of HIPAA and use AWS you need to follow their guidelines.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.