✓ Human-authored analysis; AI used for formatting and proofreading.
Recurring theme on r/aws:
"I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?"
The top reply is always some version of: "AWS won't tell you that. You need to evaluate your configuration against the Security Rule yourself."
That reply is correct and does not help.
What HIPAA requires for S3
The HIPAA Security Rule doesn't mention S3. It defines four categories of safeguards that apply to any system storing electronic protected health information (ePHI):
- Access Control (SS 164.312(a)(1)) -- Only authorized users can reach PHI
- Audit Controls (SS 164.312(b)) -- All access to PHI is logged
- Encryption (SS 164.312(a)(2)(iv), SS 164.312(e)(2)(ii)) -- Data encrypted at rest and in transit
- Retention (SS 164.316(b)(2)) -- PHI retained for minimum 6 years
Teams get stuck mapping these to S3 settings. Encryption at rest is one checkbox. But which KMS key type? Is server access logging enough, or do you need CloudTrail object-level events? Does Block Public Access count if it's only set at the account level?
How Stave evaluates HIPAA compliance
Stave is an open-source CLI that evaluates S3 configurations against compliance profiles. The built-in HIPAA profile maps 28 controls to specific Security Rule sections and evaluates them against an observation snapshot of your bucket configuration.
stave evaluate --snapshot observations/snap.json --profile hipaa
The output is a structured report with pass/fail verdicts, regulatory citations, and remediation steps:
═══ HIPAA Security Rule ═══
Bucket: phi-patient-records
Account: ***456
Snapshot: 2026-04-08T14:30:00Z
Result: FAIL
── CRITICAL ──
[FAIL] CONTROLS.001.STRICT — critical
Compliance: §164.312(a)(2)(iv) — CMK required for key revocation during breach response
Finding: Encryption uses AWS-managed key — customer cannot revoke
Remediation: Change default encryption to SSE-KMS with a customer-managed key
[PASS] CONTROLS.004 — critical
Compliance: §164.312(e)(2)(ii) — Transmission Security
[PASS] AUDIT.001 — critical
Compliance: §164.312(b) — Audit Controls
[PASS] ACCESS.001 — critical
Compliance: §164.312(a)(1) — Access Control
── HIGH ──
[FAIL] AUDIT.002 — high
Compliance: §164.312(b) — Object-level logging for PHI access audit trail
Finding: CloudTrail object-level data events not configured
Remediation: Configure a CloudTrail trail with S3 data event selector
Each finding maps directly to a HIPAA citation. Your auditor can trace the control back to the regulation.
AWS signs the Business Associate Agreement. AWS provides the encryption toggles, the logging infrastructure, and the access controls. But AWS will never evaluate whether your specific configuration satisfies the Security Rule. That is the customer's responsibility under the shared responsibility model.
Stave bridges that gap. Instead of a 47-page checklist, you get a single command that produces a pass/fail verdict with the regulatory receipts to back it up.
