A clinic runs a patient-intake assistant on AWS and must meet its HIPAA obligations. Which task remains the clinic's own responsibility rather than AWS's?
Show answer and explanation
Answer: D
Under HIPAA on AWS, the customer must sign a Business Associate Agreement with AWS and use only services that AWS has designated as HIPAA eligible for protected health information. The clinic also configures encryption, access control, and audit logging for its own workloads. AWS handles physical data center security, host hardware maintenance, and the global network, so those are not the clinic's duties.
Why the other options are wrong
- A. Physical security of AWS data centers is the provider's responsibility under the shared responsibility model, not the clinic's.
- B. Host hardware maintenance is managed by AWS for its infrastructure, so the clinic does not patch the underlying servers.
- C. The global backbone and inter-Region network are operated by AWS. Customers do not run that transport layer themselves.