<p>According to Amazon AWS</p>

<blockquote>
  <p>Customers may use any AWS service in an account designated as a HIPAA
  account, but they should only process, store and transmit PHI in the
  HIPAA-eligible services defined in the BAA. There are ten
  HIPAA-eligible services today, including AWS Snowball, Amazon
  DynamoDB, Amazon EBS, Amazon EC2, Amazon Elastic MapReduce (EMR),
  Amazon Elastic Load Balancing (ELB), Amazon Glacier, Amazon Relational
  Database Service (RDS) [MySQL, Oracle, and PostgreSQL engines only],
  Amazon Aurora [MySQL-compatible edition only], Amazon Redshift, and
  Amazon S3.</p>
</blockquote>

<p><sup>source: <a href="https://aws.amazon.com/compliance/hipaa-compliance/" rel="nofollow noreferrer">https://aws.amazon.com/compliance/hipaa-compliance/</a></sup></p>

<p>This means that as long as you are not storing or transmitting PHI in SQS, just the information about where this PHI is being stored - you probably can pass an audit reg. HIPAA compliance.</p>

<p>In the architecture you describe, the SQS queue does not need to include any PHI content. This would make it comply with the above statement.</p>

<p>More information about HIPAA compliance on AWS is available in this whitepaper from January 2017 - <a href="https://d0.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf" rel="nofollow noreferrer">https://d0.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf</a></p>

<p>Specifically SQS is mentioned and explained in the HIPAA FAQ - <a href="https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud-part-two/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud-part-two/</a>.</p>

<p><strong>update</strong>: As of May 1st 2017, SQS is now HIPAA compliant. <a href="https://aws.amazon.com/about-aws/whats-new/2017/05/amazon-simple-queue-service-sqs-is-now-a-hipaa-eligible-service/" rel="nofollow noreferrer">https://aws.amazon.com/about-aws/whats-new/2017/05/amazon-simple-queue-service-sqs-is-now-a-hipaa-eligible-service/</a></p>

CC BY-SA 3.0
2017-03-01T02:37:09.567Z
2017-05-04T09:05:07.700Z
2017-05-04T09:05:07.700Z
Evgeny Zislis
<p>I have a use case where data from S3 is queued into AWS SQS, which is in turn connected to CloudWatch, whose metrics will be triggering AWS Lambda.</p>

<p>However, I want the architecture to be <a href="https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act" rel="noreferrer">HIPAA</a> compliant. So, I have come up with this idea:</p>

<ol>
<li>Once my S3 bucket gets a file,</li>
<li>Fire up a Lambda function, which does hashing/name scrambling of the files, and copies to another S3 bucket (via <code>aws cp</code>)</li>
<li>Connect the bucket with the hashed/scrambled names to the SQS queue</li>
</ol>

<p><strong>Is this a good and secure practice? Or is there a better workaround?</strong> (Would be more than happy if I can send encrypted keys of S3 to SQS. But not sure if I can or if it is possible)</p>

<amazon-web-services><amazon-s3><amazon-sqs>
How do I work around the fact that AWS SQS is not HIPAA compliant?
Dawny33
# How do I work around the fact that AWS SQS is not HIPAA compliant?

(Asked by: username_0 on 2017-03-01)

I have a use case where data from S3 is queued into AWS SQS, which is in turn connected to CloudWatch, whose metrics will be triggering AWS Lambda.

However, I want the architecture to be [HIPAA](https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act) compliant. So, I have come up with this idea:

1. Once my S3 bucket gets a file,
2. Fire up a Lambda function, which does hashing/name scrambling of the files, and copies to another S3 bucket (via `aws cp`)
3. Connect the bucket with the hashed/scrambled names to the SQS queue

**Is this a good and secure practice? Or is there a better workaround?** (Would be more than happy if I can send encrypted keys of S3 to SQS. But not sure if I can or if it is possible)

**Tags:** amazon-web-services, amazon-s3, amazon-sqs


---

## 1 answers

### Answer by username_1 on 2017-03-01. Score: 19 | Accepted answer

According to Amazon AWS

> Customers may use any AWS service in an account designated as a HIPAA
> account, but they should only process, store and transmit PHI in the
> HIPAA-eligible services defined in the BAA. There are ten
> HIPAA-eligible services today, including AWS Snowball, Amazon
> DynamoDB, Amazon EBS, Amazon EC2, Amazon Elastic MapReduce (EMR),
> Amazon Elastic Load Balancing (ELB), Amazon Glacier, Amazon Relational
> Database Service (RDS) [MySQL, Oracle, and PostgreSQL engines only],
> Amazon Aurora [MySQL-compatible edition only], Amazon Redshift, and
> Amazon S3.

source: <https://aws.amazon.com/compliance/hipaa-compliance/>

This means that as long as you are not storing or transmitting PHI in SQS, just the information about where this PHI is being stored - you probably can pass an audit reg. HIPAA compliance.

In the architecture you describe, the SQS queue does not need to include any PHI content. This would make it comply with the above statement.

More information about HIPAA compliance on AWS is available in this whitepaper from January 2017 - <https://d0.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf>

Specifically SQS is mentioned and explained in the HIPAA FAQ - <https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud-part-two/>.

**update**: As of May 1st 2017, SQS is now HIPAA compliant. <https://aws.amazon.com/about-aws/whats-new/2017/05/amazon-simple-queue-service-sqs-is-now-a-hipaa-eligible-service/>


---

