Architecting for HIPAA or PCI DSS compliance
building auditable, compliant data handling.
isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs.
What's really being asked
The interviewer wants you to map an abstract standard like HIPAA or PCI DSS onto concrete, defensible cloud controls, and to recognize that the customer, not the provider, owns compliant configuration of their workload.
The full answer
For data isolation, shrink the scope of regulated data: place it in dedicated accounts or subscriptions and private subnets with no direct internet path, segment the network so the cardholder or health data environment is separated from general workloads, and minimize how many systems touch it. For encryption, enforce TLS for all data in transit and encrypt at rest, ideally with customer-managed keys in a KMS so you control rotation, policy, and revocation, and consider tokenization or field-level encryption so the raw sensitive values rarely appear. For access, apply least privilege with role-based access, require multi-factor authentication, prefer short-lived credentials and just-in-time elevation, and avoid standing broad permissions. For audit logging, capture all access and administrative actions, ship them to immutable, centralized storage in a restricted account with retention matching the standard, and monitor for anomalies. Operationally, sign the provider's business associate agreement for HIPAA, use services within the certified scope, run continuous compliance scanning, and document controls for auditors. Throughout, remember the shared responsibility model: a HIPAA-eligible service is not the same as a HIPAA-compliant deployment; correct configuration is yours.
The mistakes people make
Assuming that using a provider's compliant or eligible service makes the whole application compliant. Encrypting at rest but leaving data in transit unprotected, or vice versa. Granting broad standing access instead of least privilege and just-in-time. Forgetting durable, tamper-resistant audit logs.
What usually comes next
What is the difference between a HIPAA-eligible service and compliance? How does tokenization reduce PCI scope? How long must audit logs be retained?
A concrete example
Cardholder data lives in an isolated account, encrypted with a customer-managed key, tokenized so services handle only tokens, accessed via just-in-time roles with MFA, and every action logged to an immutable archive, sharply narrowing PCI scope.
Interview question
A team uses a cloud provider's HIPAA-eligible database service and assumes the application is therefore compliant. What is the flaw in this reasoning?
- a.Eligibility means the provider signs off on the entire application architecture
- b.HIPAA-eligible services automatically encrypt and audit everything for you
- c.Eligibility enables compliance, but correct configuration and controls remain the customer's responsibilityCorrect
- d.There is no flaw; using an eligible service satisfies all requirements
Why? this is the answer
An eligible service can be used in a compliant way, but the customer must still configure isolation, encryption, access, and logging correctly. Eligibility never certifies the whole deployment automatically.
Just read this? Test yourself on what you have been reading.
Read the original → cloudsecurityalliance.org
- #compliance
- #hipaa
- #pci-dss
- #encryption
- #security
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on compliance — each one lists the topics its interview covers.
See open roles