SOA-C02 Question 192
Select 3Your company operates in the healthcare industry and must comply with HIPAA regulations. You are tasked with deploying an application to AWS, which processes sensitive Protected Health Information (PHI). Which of the following steps should you take to validate your AWS Region and service selections to ensure compliance?
- A
Verify that the AWS Region you select supports signing a Business Associate Agreement (BAA) with AWS.
- B
Use only AWS services that are listed as HIPAA-eligible in AWS documentation.
- C
Deploy the application in the AWS Region closest to the end users for better performance, regardless of compliance.
- D
Ensure that the selected AWS Region is covered by your organization's compliance framework.
- E
Enable AWS CloudTrail logging to track all API activity in your AWS environment.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure compliance with HIPAA requirements, you must select an AWS Region that supports signing a BAA with AWS, use only HIPAA-eligible services, and validate that the Region is covered under your organization's compliance framework. These steps directly address the regulatory requirements for processing PHI. While performance and monitoring are important, they do not address the specific need to validate AWS Region and service selections for compliance.
- A. Correct.
Correct: Signing a BAA with AWS is required for HIPAA compliance, and you must ensure the AWS Region supports this agreement.
- B. Correct.
Correct: Only HIPAA-eligible services can process PHI, so it is critical to verify that the services you intend to use are compliant.
- C. Incorrect.
Incorrect: While performance is important, compliance always takes precedence over proximity to end users when dealing with regulatory requirements.
- D. Correct.
Correct: It is essential to ensure that the AWS Region you select aligns with your organization's compliance framework and regulatory requirements.
- E. Incorrect.
Incorrect: While enabling CloudTrail is a best practice for monitoring, it is not directly related to validating AWS Region and service selections for compliance.