CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Exam Question Walkthrough: HIPAA Compliance in AWS Solutions
Explore how to approach AWS Certified Solutions Architect - Associate questions on HIPAA compliance. Learn the correct answer and why others fail.
Designing solutions that comply with regulations like HIPAA can trip up many candidates. Understanding the specific requirements for data security is key to selecting the right AWS services.
The question
A healthcare company is designing a solution to store and process patient data in compliance with HIPAA regulations. Which AWS services and features should they utilize to ensure data security?
- A. Amazon RDS with encryption and AWS IAM for access control.
- B. Amazon S3 with public access and AWS CloudFormation.
- C. AWS Lambda with no encryption and AWS SES for notifications.
- D. Amazon EC2 with security groups and public IPs.
Think before you scroll
Consider the security requirements mandated by HIPAA. This includes encryption of sensitive data and restricted access control. Analyze each option against these criteria.
The answer
The correct option is A: Amazon RDS with encryption and AWS IAM for access control. This combination ensures that sensitive patient data is encrypted at rest and that access is tightly controlled, meeting HIPAA regulations.
Why the other options lose
- B. Amazon S3 with public access and AWS CloudFormation. Public access to S3 buckets poses a significant security risk, as it allows unauthorized users to access sensitive data. HIPAA requires strict access controls, making this option unsuitable.
- C. AWS Lambda with no encryption and AWS SES for notifications. Lack of encryption means sensitive data is at risk. While AWS Lambda can be used securely, not employing encryption makes this option non-compliant with HIPAA.
- D. Amazon EC2 with security groups and public IPs. Exposing EC2 instances with public IPs increases vulnerability to attacks. Security groups can restrict access, but without additional layers of encryption and access control, this does not meet HIPAA standards.
The concept behind it
The principle here is to always prioritize data encryption and access management when dealing with sensitive information, particularly in regulated industries like healthcare. AWS services must be configured to ensure compliance with standards such as HIPAA, focusing on data protection and controlled access.
Exam trap to remember
Remember the two-question rule: if data sensitivity is implied, always look for encryption and strict access controls in your options.