01Introduction
Migrating Legacy EHR to AWS Without Breaking HIPAA
02Problem Statement
- Healthcare SaaS client running on-prem SQL Server + file servers storing PHI
- Business goal: reduce infrastructure cost 40% while achieving HIPAA compliance
- Challenge: zero downtime requirement, active patient records, BAA obligations
- Risk: any PHI exposure during migration triggers breach notification rules
- Timeline: 12-week phased migration with live production cutover
03Proposed Solution
Phase 1
Zero-Trust AWS Architecture for PHI Workloads
- Deployed VPC with private subnets; no public-facing EC2 instances
- RDS MySQL Multi-AZ with AES-256 encryption at rest + TLS in transit
- S3 with Object Lock (WORM) for audit logs; KMS CMK per data classification
- CloudTrail + GuardDuty + Security Hub for continuous threat detection
- IAM roles with least-privilege; no long-lived access keys anywhere
Phase 2
Phased Migration with Live Cutover
- Phase 1: Replicated on-prem DB to RDS using AWS DMS with ongoing replication
- Phase 2: Migrated application tier to ECS Fargate behind ALB with WAF
- Phase 3: DNS cutover during 2AM maintenance window; DMS lag under 5 seconds
- Implemented VPN + PrivateLink for third-party lab system integrations
- Signed BAA with AWS; documented all PHI data flows for audit readiness
04Technologies
- AWS
- RDSECS FargateS3KMSCloudTrailGuardDutyWAFALBDMS
- IaC
- Terraform with remote state in S3 + DynamoDB locking
- Security
- AWS Security HubMacie for PHI detection in S3
- Monitoring
- CloudWatch dashboards + SNS alerting
- Compliance
- HIPAA BAANIST 800-66 controls mapping