# Is my S3 bucket HIPAA compliant? The question AWS can't answer > Source: > Published: 2026-10-19 12:19:26+00:00 # Is my S3 bucket HIPAA compliant? The question AWS can't answer ✓ Human-authored analysis; AI used for formatting and proofreading. Recurring theme on r/aws: "I'm storing PHI in S3. I enabled encryption, turned on logging, set the bucket to private. Are we HIPAA compliant?" The top reply is always some version of: "AWS won't tell you that. You need to evaluate y our configuration against the Security Rule yourself." That reply is correct and does not help. The HIPAA Security Rule doesn't mention S3. It defines four categories of safeguards that apply to any system storing electronic protected health information (ePHI): Access Control (SS 164.312(a)(1)) -- Only authorized users can reach PHI Audit Controls (SS 164.312(b)) -- All access to PHI is logged Encryption (SS 164.312(a)(2)(iv), SS 164.312(e)(2)(ii)) -- Data encrypted at rest and in transit Retention (SS 164.316(b)(2)) -- PHI retained for minimum 6 years Teams get stuck mapping these to S3 settings. Encryption at rest is one checkbox. But which KMS key type? Is server access logging enough, or do you need CloudTrail object-level events? Does Block Public Access count if it's only set at the account level? Stave is an open-source CLI that evaluates S3 configurations against compliance profiles. The built-in HIPAA profile maps 28 controls to specific Security Rule sections and evaluates them against an observation snapshot of your bucket configuration. stave evaluate --snapshot observations/snap.json --profile hipaa The output is a structured report with pass/fail verdicts, regulatory citations, and remediation steps: ═══ HIPAA Security Rule ═══ Bucket: phi-patient-records Account: ***456 Snapshot: 2026-04-08T14:30:00Z Result: FAIL ── CRITICAL ── [FAIL] CONTROLS.001.STRICT — critical Compliance: §164.312(a)(2)(iv) — CMK required for key revocation during breach response Finding: Encryption uses AWS-managed key — customer cannot revoke Remediation: Change default encryption to SSE-KMS with a customer-managed key [PASS] CONTROLS.004 — critical Compliance: §164.312(e)(2)(ii) — Transmission Security [PASS] AUDIT.001 — critical Compliance: §164.312(b) — Audit Controls [PASS] ACCESS.001 — critical Compliance: §164.312(a)(1) — Access Control ── HIGH ── [FAIL] AUDIT.002 — high Compliance: §164.312(b) — Object-level logging for PHI access audit trail Finding: CloudTrail object-level data events not configured Remediation: Configure a CloudTrail trail with S3 data event selector Each finding maps directly to a HIPAA citation. Your auditor can trace the control back to the regulation. AWS signs the Business Associate Agreement. AWS provides the encryption toggles, the logging infrastructure, and the access controls. But AWS will never evaluate whether your specific configuration satisfies the Security Rule. That is the customer's responsibility under the shared responsibility model. Stave bridges that gap. Instead of a 47-page checklist, you get a single command that produces a pass/fail verdict with the regulatory receipts to back it up. ## Key Takeaways - •The HIPAA Security Rule doesn't mention S3. - •This story was reported by **Dev.to** , covering developments in the**dev** space. - •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage. 📖 Continue reading the full article: [Read Full Article on Dev.to →](https://dev.to/bala_paranj_059d338e44e7e/is-my-s3-bucket-hipaa-compliant-the-question-aws-cant-answer-ci9)