Question: Is DynamoDB HIPAA compliant?

Answer

DynamoDB is an AWS HIPAA-eligible service, so it can be used in applications that handle protected health information under an executed AWS Business Associate Addendum (BAA). Using DynamoDB alone does not make an application HIPAA compliant.

Confirm that the relevant AWS accounts are covered by your BAA before storing or processing PHI. Review the eligibility and contractual requirements of every service in the data path, including backups, exports, analytics integrations, logs and downstream consumers.

AWS manages the service infrastructure. You remain responsible for application access, least-privilege IAM, appropriate key management, logging, retention, recovery procedures and your organization's operational controls. Encryption at rest is always enabled for DynamoDB, and API traffic uses HTTPS, but encryption does not replace authorization or audit controls.

Avoid placing sensitive patient information in resource names or unnecessary logs. If you need to audit item access, configure the relevant CloudTrail data events; management-event logging alone does not capture every read and write to your table.

Use AWS Artifact for applicable agreements and compliance reports, and assess the complete workload against your organization's requirements. The DynamoDB security guide and encryption guide explain the technical controls.

Source: AWS HIPAA-eligible services.