We store PHI data in AWS DynamoDB, we store connected non PHI in AWS Neptune. We will reference this through a user id, this will generated at user creation, the id is time based hash.

Is this a probelm with the HIPAA rules?

From my technical view is AWS Neptune hipaa compliance because it supports Encryption at rest an transport encryption. But it is not in the BAA, that makeing not hipaa compliant.


The question is actually, is it hipaa compliance when i reference phi data with non phi data through a time based hash, when the non phi data stored in a not hipaa compliance db?

  • Take a look here: aws.amazon.com/compliance/hipaa-compliance. I don't think you are HIPAA compliance without using this methods. – Yehuda Mar 25 '18 at 12:50
  • Thanks for the reply but this was not the question. I have updated my question to clairify. – Aron Mar 25 '18 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.