Architecting for HIPAA or PCI DSS compliance

WHAT THIS TESTS The interviewer wants you to map an abstract standard like HIPAA or PCI DSS onto concrete, defensible cloud controls, and to recognize that the customer, not the provider, owns compliant configuration of their workload.

A GOOD ANSWER COVERS For data isolation, shrink the scope of regulated data: place it in dedicated accounts or subscriptions and private subnets with no direct internet path, segment the network so the cardholder or health data environment is separated from general workloads, and minimize how many systems touch it. For encryption, enforce TLS for all data in transit and encrypt at rest, ideally with customer-managed keys in a KMS so you control rotation, policy, and revocation, and consider tokenization or field-level encryption so the raw sensitive values rarely appear. For access, apply least privilege with role-based access, require multi-factor authentication, prefer short-lived credentials and just-in-time elevation, and avoid standing broad permissions. For audit logging, capture all access and administrative actions, ship them to immutable, centralized storage in a restricted account with retention matching the standard, and monitor for anomalies. Operationally, sign the provider's business associate agreement for HIPAA, use services within the certified scope, run continuous compliance scanning, and document controls for auditors. Throughout, remember the shared responsibility model: a HIPAA-eligible service is not the same as a HIPAA-compliant deployment; correct configuration is yours.

COMMON WRONG ANSWERS Assuming that using a provider's compliant or eligible service makes the whole application compliant. Encrypting at rest but leaving data in transit unprotected, or vice versa. Granting broad standing access instead of least privilege and just-in-time. Forgetting durable, tamper-resistant audit logs.

LIKELY FOLLOW-UPS What is the difference between a HIPAA-eligible service and compliance? How does tokenization reduce PCI scope? How long must audit logs be retained?

ONE CONCRETE EXAMPLE Cardholder data lives in an isolated account, encrypted with a customer-managed key, tokenized so services handle only tokens, accessed via just-in-time roles with MFA, and every action logged to an immutable archive, sharply narrowing PCI scope.