CLF-C02 Question 95
Select 3Your organization is planning to host a healthcare application on AWS. The application will store sensitive patient data and must comply with HIPAA (Health Insurance Portability and Accountability Act) regulations. Which of the following actions should you take to ensure compliance with AWS services?
- A
Sign a Business Associate Addendum (BAA) with AWS.
- B
Ensure that the AWS services you plan to use are HIPAA-eligible.
- C
Enable AWS Config to automatically enforce HIPAA compliance across all services.
- D
Use Amazon S3 with encryption enabled for storing patient data.
- E
Deploy your application in an Amazon EC2 instance without additional configurations.
Show answer and explanation
Correct answers: A, B, D
Explanation
To comply with HIPAA requirements when using AWS, customers must sign a Business Associate Addendum (BAA) with AWS, ensure that the services they use are HIPAA-eligible, and implement appropriate measures such as data encryption. AWS provides various tools and resources to help customers achieve compliance, but it is ultimately the customer's responsibility to configure their environment correctly.
- A. Correct.
AWS requires a signed Business Associate Addendum (BAA) for customers using services to process, store, or transmit PHI (Protected Health Information). This is a necessary step for HIPAA compliance.
- B. Correct.
Not all AWS services are HIPAA-eligible. Customers must verify that the services they plan to use are included in AWS's HIPAA compliance program.
- C. Incorrect.
AWS Config does not automatically enforce HIPAA compliance. While it can help monitor and manage compliance, additional steps are required to meet HIPAA requirements.
- D. Correct.
Using encryption for sensitive data, such as storing patient data in Amazon S3 with encryption enabled, is a key best practice for HIPAA compliance.
- E. Incorrect.
Deploying an application on an Amazon EC2 instance alone does not ensure HIPAA compliance. Additional configurations and safeguards are required.