How to prepare for the proposed HIPAA Security Rule update with AWS Backup and the HIPAA Assistant

This article explains how to prepare for the proposed HIPAA Security Rule update, which introduces specific technical and governance requirements for protecting electronic protected health information (ePHI) on AWS.

• Proposed rule makes flexible safeguards into specific requirements: MFA, encryption at rest/transit, 48-hour backups, 72-hour system restoration, and annual compliance audits
• AWS Backup with Vault Lock and continuous backup meets 48-hour recovery point and 72-hour restoration objectives
• AWS Step Functions orchestrates recovery workflows; AWS Backup restore testing automates monthly testing requirements
• HIPAA Assistant open-source tool reviews infrastructure-as-code and application code for Security Rule gaps with CFR citations
• Six-step roadmap: accept AWS BAA, assess current state, close direct gaps, integrate tooling into workflows, build remediation roadmap, and generate compliance evidence
• Compliance date estimated for early 2028; penalties range from $145 to $2.19M per violation depending on culpability

Organizations handling ePHI should start compliance preparation now using AWS services and the HIPAA Assistant, regardless of final rule timing.