Frameworks · HIPAA
HIPAA Security Rule readiness on AWS
TrustProof scans your AWS account through a read-only role and maps the findings to selected HIPAA Security Rule technical safeguards, so you can see where your AWS environment stands before an independent assessment. There is no official HIPAA certification; the CPA dashboard organises your AWS evidence so an independent assessor can review it.
Key facts
What you can check
- Mapped Security Rule references
- Selected AWS checks give evidence context for 13 technical safeguard references: §164.308(a)(1)(ii)(D), §164.308(a)(3), §164.308(a)(4), §164.308(a)(7), §164.308(a)(8), §164.312(a)(1), §164.312(a)(2)(iii), §164.312(a)(2)(iv), §164.312(b), §164.312(c)(1), §164.312(d), §164.312(e)(1) and §164.312(e)(2)(ii). The other 16 §164.312 references are not mapped by the current AWS checks.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Red, amber, green readiness
- Your dashboard shows a red, amber or green HIPAA status, worked out from your latest scan and the evidence collected for each mapped control.
- CPA dashboard
- The CPA dashboard lists each mapped HIPAA control with its evidence, source, collection date and freshness, and shows evidence gaps, so your assessor can review it. Export it as PDF or CSV.
- SHA-256 evidence snapshots
- Each scan finding used as evidence is stored once as a snapshot with a SHA-256 fingerprint and its collection date, so any later change can be detected.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
Guided programme
Guided HIPAA readiness programme
Live: a guided HIPAA readiness programme with 32 requirements in 5 areas, covering Security Rule sections §164.308, §164.310, §164.312 and §164.316 and Breach Notification §164.400–414, 18 document types with review dates, owner sign-offs pinned to a SHA-256 fingerprint and an assessor dashboard with two-step verification.
What TrustProof does
- Scans your AWS account through a read-only role and ranks findings by risk
- Maps findings to selected HIPAA Security Rule safeguards and shows a red, amber or green readiness status
- Collects the evidence for each mapped control in a CPA dashboard, exportable as PDF or CSV
- Prepares fixes that your engineer approves before anything changes
What TrustProof doesn't do
- TrustProof does not certify, and there is no official HIPAA certification.
- It does not find ePHI for you; you declare which systems hold it.
- It is not legal advice and does not cover the HIPAA Privacy Rule.
FAQ
Frequently asked questions
Is there a HIPAA certification?
No. There is no official HIPAA certification. An independent assessor chosen by your organisation reviews your safeguards and evidence; TrustProof prepares the AWS evidence.
Which parts of HIPAA does the scan cover?
Selected AWS checks give evidence context for 13 Security Rule technical safeguard references (§164.308(a)(1)(ii)(D), §164.308(a)(3), §164.308(a)(4), §164.308(a)(7), §164.308(a)(8), §164.312(a)(1), §164.312(a)(2)(iii), §164.312(a)(2)(iv), §164.312(b), §164.312(c)(1), §164.312(d), §164.312(e)(1) and §164.312(e)(2)(ii)). They do not cover the whole Security Rule, and the Privacy Rule is not covered.
Can TrustProof find where our ePHI is stored?
No. You declare which systems hold ePHI. TrustProof checks the AWS configuration of your account through a read-only role, but it cannot see or classify the data itself.
Is this legal advice?
No. TrustProof gives readiness guidance and organises evidence. Talk to your legal and compliance advisers about your obligations.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.