Give your auditor a control-mapped evidence package—not a certificate claiming that S3 is “compliant.” It should combine applicable AWS assurance reports with dated evidence of your own in-scope buckets, configurations, access and activity logging, control evaluations, and operating records. First ask the auditor for the control list, system scope, required format, and lookback period.
Start with the audit request and define the scope
There is no universal set of files that proves an S3 environment meets every HIPAA obligation. The evidence depends on the controls under review, the system boundary, the audit period, and how your organization operates its safeguards. Use the auditor’s request list as the package index, and map each requested control to specific evidence.
As an Amazon Associate I earn from qualifying purchases.
For each control, record its identifier and description, the in-scope AWS account, Region, and bucket, the evidence owner, collection date and covered period, the source, the result and any exceptions, and the artifact’s location. Keep the original export or record alongside a brief explanation of what it demonstrates and what it does not.
- Confirm which accounts, Regions, buckets, access points, and data flows are in scope.
- Identify where electronic protected health information (ePHI) is stored, processed, or transferred, and who owns each relevant resource.
- Ask whether the auditor needs point-in-time configuration evidence, records covering a period, operating procedures, or all three.
- Agree on acceptable formats and secure delivery methods before exporting sensitive logs or reports.
Include AWS assurance, but distinguish it from your own controls
AWS makes third-party assurance reports available through AWS Artifact, and Amazon S3 is assessed under programs that include HIPAA. Include the reports relevant to the services and audit period, along with their scope and reporting dates. Those reports describe AWS’s assurance; they do not establish that your particular buckets, identities, logging, or procedures are configured and operated appropriately.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
Before using HIPAA-eligible AWS services with PHI, a covered entity or business associate must have an AWS Business Associate Addendum (BAA) in place. Confirm that prerequisite and the eligibility of the services in your workload. Eligibility does not transfer your responsibilities for customer-side configuration and operation. AWS describes the customer’s compliance responsibility as dependent on data sensitivity, organizational objectives, and applicable laws and regulations.
Build a control-mapped evidence package
Use this checklist to assemble candidate evidence, then include only what supports the auditor’s actual requests. It is not a universal HIPAA control mapping.
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
| Evidence area | Artifacts to prepare | What they can show |
|---|---|---|
| Scope and ownership | AWS account and Region list; bucket inventory; data owner; ePHI boundary and data-flow description | Which resources and flows are in scope, and who is responsible for them. |
| AWS assurance | Applicable AWS Artifact reports and the relevant AWS service-scope reference | AWS-level audited controls and the report period—not your workload’s configuration. |
| Stored-data protection | Bucket encryption configuration; key configuration and ownership where applicable; S3 Inventory report fields for object encryption status | How encryption is configured and whether inventoried objects have the expected status. S3 encrypts new objects at rest by default using SSE-S3 unless another option is configured. |
| Access restrictions | Bucket and access-point policies; S3 Block Public Access state; relevant IAM role and policy excerpts; AWS Config findings | How access is restricted and whether settings match intended policy. Prefer machine-readable exports or rule results where available; a screenshot alone may be difficult to validate. |
| Activity logging | CloudTrail trail configuration and relevant events for the requested period; S3 server access logging configuration and samples if used | Whether requested activity is captured and what records are available. Verify that CloudTrail data events cover the in-scope buckets and period when object-level activity is required. |
| Configuration and change history | AWS Config recorder scope; rule definitions and evaluations; configuration snapshots; remediation and change records | Whether monitored resources match intended settings and how changes are reviewed. |
| Retention and integrity | Log retention settings; access restrictions on log destinations; S3 Object Lock configuration if used | How retained evidence is protected from premature deletion or alteration. Object Lock can help protect CloudTrail logs. |
| Exceptions and manual controls | Risk acceptances, tickets, periodic review records, procedures, training records, incident records, and control-owner sign-offs as requested | Human-operated safeguards and decisions that automated snapshots cannot establish. |
Attach collection context to every export: account, Region, resource, collection time, and the control it supports. A passing AWS Config rule, one screenshot, or an AWS assurance report alone does not prove that all HIPAA safeguards are met.
Choose evidence sources for the question they answer
AWS Artifact: AWS-level assurance
Download the reports relevant to the audit period and preserve their report scope and dates. Use them to support AWS-level assurance, not as a substitute for evidence of your workload’s implementation.
Rank #3
- Capacity Display Variance: 500GB external ssd often appears as around 465GB on Windows. MacOS can show full 500 GB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
AWS Config: resource settings and evaluation history
Ensure recording covers the S3 resource types in scope, then retain the relevant configuration history, snapshots, and rule evaluations. AWS Config can help assess settings against desired configurations. AWS’s managed rules support general purpose buckets; its documentation says Config does not record configuration changes for directory buckets. If directory buckets are in scope, do not present Config history as evidence of changes it does not record.
S3 Inventory: object-level reporting
Choose inventory fields that answer the request, such as encryption or replication status. Preserve the report date and scope with the export. An inventory report describes the objects represented by that report; it is not, by itself, evidence of access restrictions or ongoing operational review.
Rank #4
- NEARLY 2X FASTER THAN OUR PREVIOUS GENERATION(8) – move 1,000 high-res photos in under 60 seconds(6) with up to 2000MB/s transfer speeds(2).
- IP65 RATING AND UP TO 3M DROP PROTECTION(3) – protects against spills and drops.
- POCKET-SIZED – fits easily in pockets and small bags.
- SPACE TO OWN YOUR AI CONTENT – speed and capacity to download your high-res clips and photo edits.
- 256-BIT AES ENCRYPTION(4) – helps keep private files secure with password protection.
CloudTrail and S3 server access logging: activity records
AWS recommends CloudTrail for S3 bucket-level and object-level actions. CloudTrail data events can record object API activity, but object-level coverage requires appropriate data-event configuration. Inspect the trail selectors and verify coverage for the requested buckets and time period instead of assuming that enabling a trail captured every relevant object operation.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Evidence source | Useful for | Check before submitting |
|---|---|---|
| CloudTrail | Bucket and object actions; records that can identify the user, request, time, and source IP address; log integrity validation | Whether relevant data events were enabled for the in-scope buckets during the audit period, and the trail’s retention and delivery settings. |
| S3 server access logs | A different record of requests to a bucket, with fields and capabilities that can differ from CloudTrail | Whether logging was configured, whether relevant logs were delivered for the requested period, and whether the records contain the fields the auditor needs. |
Select the source or combination of sources that covers the requested events, period, delivery, retention, and search needs. Do not treat one as a universal replacement for the other.
Best Value
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
AWS Audit Manager: evidence collection and organization
A HIPAA framework in AWS Audit Manager can help organize preparation. Depending on the enabled data sources, Audit Manager can gather AWS Config and Security Hub checks, CloudTrail user activity, API configuration snapshots, and manually uploaded evidence. Review the source mapping for each framework item, enable the relevant data sources, inspect inconclusive items, and add manual records where automation cannot establish that a control operated.
Audit Manager is a collector and organizer, not a compliance decision-maker. AWS says it does not assess whether an organization complies and may not collect all information an audit needs. An automated result should therefore be paired with the underlying evidence and any operational records the control requires.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Separate current HIPAA requirements from proposed changes
AWS guidance dated July 31, 2026 describes the HIPAA Security Rule’s Technical Safeguards at 45 CFR §164.312 as including standards and implementation specifications for access control, audit controls, integrity, authentication, and transmission security. The same guidance discusses HHS’s January 2025 Notice of Proposed Rulemaking (NPRM), including proposed mandatory encryption and multifactor authentication. It stated that, as of June 2026, a final rule had not been published.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDo not describe NPRM proposals as effective legal requirements just because they were proposed. For an audit, identify the rule and period that apply, and verify the current rulemaking status before relying on a dated statement about whether a proposal has become final.
Package and hand off the evidence
- Create the index. Start with the auditor’s control list. Add the in-scope account, Region, bucket or other resource, owner, evidence period, source, result, exceptions, and artifact location for each item.
- Collect dated artifacts. Export the relevant AWS Artifact reports, configuration and inventory evidence, logging settings and records, control evaluations, and requested operating documents. Label each artifact with its collection date and coverage period.
- Check coverage and gaps. Compare the request against actual recorder scope, rule evaluations, trail selectors, data-event coverage, inventory fields, and log retention. Record exceptions plainly; do not imply that uncollected periods or resources are covered.
- Add concise explanations. For each artifact, explain the resource and period it covers, the control it supports, and any limitation. Keep the raw evidence available so the auditor can validate the explanation.
- Deliver securely and track follow-ups. Use the agreed transfer method, restrict access to sensitive evidence, and maintain a record of what was provided and when. Provide additional artifacts or clarifications against the corresponding control rather than sending an unindexed dump.
AWS Audit Manager may help collect evidence, but AWS cautions that it is not a substitute for legal counsel or compliance experts. Use your compliance team or qualified advisers to interpret the applicable requirements and control design.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
