Amazon Web Services (AWS) has announced that the Amazon Elasticsearch Service has achieved HIPAA eligibility, as well as PCI and ISO compliance. The latest announcement from AWS shares the expanded scope of the service’s compliance status.
With the latest news, AWS customers can use the Amazon Elasticsearch Service to store and analyze protected health information (PHI) and build HIPAA compliant applications. Customers must follow the cloud shared responsibility model and have a signed Business Associates agreement in place to use the service in a HIPAA compliant manner.
Additionally, Amazon Elasticsearch Service is now in-scope of AWS’ PCI DSS which will allow you to store, process, or transmit cardholder data using the service. Additionally, Amazon Elasticsearch Service is in-scope of AWS’ ISO 9001, 27001, 27017, and 27018 certifications. PCI DSS and ISO are among the most recognized security standards for security management in the cloud.
Amazon Elasticsearch
Amazon Elasticsearch Service, is Amazon’s managed Elasticsearch that allows cloud users to search, analyze, and visualize real-time data. Amazon Elasticsearch integrates with open-source solutions including Kibana and Logstash, giving organizations an easy option for analyzing log data and integrating data into other AWS services such as Amazon Cloudwatch and Amazon Lambda.
Amazon’s service is real benefit for users looking for a fully hosted and scalable Elasticsearch solution, without major configuration. Easy-to-use APIs and real-time analytics capabilities allow teams the ability to work with data in cases such as log analytics, application monitoring, and full text-search.
What Does This Mean For AWS Users?
Cloud users may use Amazon Elasticsearch Service with PHI, as long as they fulfill specific compliance requirements. Amazon operates on a Shared Responsibility Model meaning that security is a “shared responsibility” between AWS and organizations. Organization’s may enter a Business Associates Agreement (BAA) with the cloud provider, where Amazon will take responsibility for physical safeguards for HIPAA and regulatory compliance. It is up to the organization to implement the necessary HIPAA administrative policies and technical safeguards and monitoring.
Dash can help organization’s to configure, monitor and maintain HIPAA compliance in Amazon Web Services.
FAQ: HIPAA Security for Amazon Elasticsearch and OpenSearch
Is Amazon Elasticsearch Service now called Amazon OpenSearch Service?
Yes. Amazon Elasticsearch Service was renamed Amazon OpenSearch Service. When reviewing documentation for a new healthcare deployment, use the current OpenSearch guidance and verify the HIPAA eligibility of the specific service and features you plan to use. Historical announcements should not replace a review of current AWS requirements.
How should I protect search indexes containing patient information?
Treat search indexes as sensitive data stores, not simply as copies of your primary database. Encrypt data at rest and in transit, restrict network access, and limit permissions to the indexes and operations each user or application needs. Include indexed patient data in your risk assessment, retention policies, and incident response procedures.
Can application logs contain PHI even if patient records are stored elsewhere?
Yes. Request bodies, search queries, error messages, and application traces can contain patient identifiers or clinical information. Review logging and ingestion pipelines before sending data to your search service. Remove or redact unnecessary sensitive fields, and protect any remaining ePHI throughout collection, storage, and analysis.
Is encryption enough to protect PHI in a search service?
No. Encryption does not prevent an authorized account with excessive permissions from reading or exporting patient information. Combine encryption with strong authentication, least-privilege access, network restrictions, audit logging, and regular access reviews. Protect encryption keys and limit who can change their permissions.
How can healthcare applications prevent users from seeing other patients’ search results?
Enforce authorization on every search request rather than relying on dashboard filters or hidden interface elements. Where supported, use index-, document-, or field-level permissions to restrict access. Test that users cannot bypass these restrictions through direct API requests, exports, or alternate search interfaces.
What activity should be audited when a search service handles ePHI?
Record relevant authentication events, permission changes, administrative actions, and access to sensitive indexes. Distinguish AWS management activity from searches and document access: management API logs alone do not provide a complete record of how users access indexed data. Protect audit logs and review them for unusual activity.
Do snapshots and exported search results need the same protection as the original data?
Yes. Snapshots, exports, and downloaded reports containing ePHI remain sensitive even when stored outside the search cluster. Apply appropriate encryption, access restrictions, retention rules, and secure disposal procedures. Include these copies in your data inventory and recovery testing.
Does deleting a patient record from the source database remove it from the search index?
Not necessarily. A search index may retain its own copy until your application or synchronization pipeline updates or deletes it. Design and test deletion workflows across the source database, indexes, caches, and exports. Manage backup copies under documented retention and disposal policies, accounting for applicable recordkeeping requirements.
