How to Achieve HIPAA Compliance in Amazon Redshift

What makes a Redshift cluster HIPAA-eligible?

HIPAA eligibility requires encryption at rest and in transit, audit logging, least-privilege IAM, and execution within an AWS HIPAA Account with a signed BAA.

How do I encrypt data at rest?

Enable AWS-managed KMS encryption when creating the cluster or run ALTER CLUSTER to rotate keys. All tables and snapshots inherit encryption.

Example

CREATE CLUSTER my_hipaa_cluster
KMS_KEY_ID 'arn:aws:kms:us-east-1:123:key/abcd'
ENCRYPTED;

How do I enforce SSL in transit?

Set the parameter group value require_ssl=true.Client connections must include sslmode=require.

How do I mask PHI in query results?

Create views that exclude or hash PHI columns. Grant users access to the views, not the base tables.

Example

CREATE VIEW v_customers_public AS
SELECT id,
sha256(email) AS email_hash,
created_at
FROM customers;

How do I audit every query?

Turn on useractivitylog and export to S3.Configure lifecycle rules to retain logs for six years.

Example

ALTER SYSTEM SET enable_user_activity_logging = true;

How do I configure least-privilege access?

Assign users to groups with only required permissions. Remove default CREATE and ALTER rights.

Example

CREATE GROUP analysts;
REVOKE ALL ON SCHEMA public FROM GROUP analysts;
GRANT SELECT ON v_customers_public TO GROUP analysts;

Best practices summary

Encrypt everywhere, log everything, restrict access, rotate keys, test disaster recovery, and document compliance controls.

.