How Claria configures your AWS account to meet HIPAA requirements, what the app handles for you, and what remains your responsibility as a covered entity.
If you are a psychologist or clinical practitioner drafting reports that contain patient information, you are handling Protected Health Information (PHI). HIPAA’s Security Rule (45 CFR 164.308, 164.310, 164.312) requires you to protect that data with administrative, physical, and technical safeguards.
When you use a cloud service to store or process PHI, that cloud provider becomes a Business Associate. Per HHS guidance on cloud computing, this is true even if the provider cannot view the data because it is encrypted. You must sign a Business Associate Agreement (BAA) before placing PHI on the service.
With Claria, AWS is your only Business Associate. The Claria app runs on your computer and connects directly to your AWS account. Claria’s developers never see your data, credentials, or usage. The BAA is between you and AWS.
When you run the setup wizard, Claria’s provisioner automatically creates and hardens the following AWS resources in your account. The dashboard continuously monitors these settings and alerts you if anything drifts from the desired state.
claria-admin IAM user with least-privilege permissions§164.308(a)(3)(i), §164.308(a)(4)(i)
§164.312(a)(2)(iv), §164.308(a)(1)(ii)(B)
_cloudtrail/§164.312(b), §164.308(a)(3)(ii)(A)
§164.308(b)(1)
§164.308(b)(1), §164.502(b)
§164.312(e)(1)
The table below maps specific HIPAA Security Rule requirements to the technical controls Claria provisions in your AWS account.
| Requirement | CFR citation | Claria’s control |
|---|---|---|
| Encryption at rest | §164.312(a)(2)(iv) | S3 bucket with AES-256 server-side encryption enforced |
| Encryption in transit | §164.312(e)(1) | All AWS API calls use TLS; all endpoints are HTTPS-only |
| Access controls | §164.312(a)(1) | Dedicated IAM user with least-privilege policy, resource-scoped to data bucket |
| Audit controls | §164.312(b) | CloudTrail records every API call with encrypted log storage |
| Integrity controls | §164.312(c)(1) | S3 versioning — objects cannot be silently overwritten or deleted |
| Risk management | §164.308(a)(1)(ii)(B) | Dashboard scans all infrastructure resources and reports configuration drift |
| No public exposure | §164.308(a)(3)(i) | S3 public access block (all four flags) prevents accidental public access |
| BAA with cloud provider | §164.308(b)(1) | Claria checks for active AWS BAA and blocks provisioning until acknowledged |
| AI provider compliance | §164.308(b)(1) | Bedrock is HIPAA-eligible under the AWS BAA; no data retention or training |
| Minimum necessary | §164.502(b) | Only files attached to a specific client are sent to the model |
| Data residency | §164.312(a)(1) | All data in your own AWS account in your chosen region; Claria developers have zero access |
From the AWS Config HIPAA Security conformance pack, Claria directly addresses:
| AWS Config Rule | What Claria does |
|---|---|
s3-bucket-server-side-encryption-enabled |
Enforces AES-256 encryption on the data bucket |
s3-bucket-versioning-enabled |
Enables versioning for integrity and recovery |
s3-bucket-public-read-prohibited |
All four public access block flags set |
s3-bucket-public-write-prohibited |
All four public access block flags set |
cloudtrail-enabled |
Creates and enables a CloudTrail trail |
iam-policy-no-statements-with-admin-access |
IAM policy is scoped; no Action: * + Resource: * |
iam-policy-no-statements-with-full-access |
Each IAM statement is scoped to specific actions |
iam-root-access-key-check |
Setup wizard guides away from root credentials |
Claria automates the technical configuration of your AWS resources. But HIPAA compliance extends beyond infrastructure. Per HHS guidance, the covered entity retains ultimate responsibility even when using a cloud provider.
Claria is designed so that you own all the infrastructure. This is both a feature and a responsibility.
The feature: No third-party SaaS vendor has access to patient data. There is no vendor lock-in, no data escrow, no subscription that could lapse and lock out access to records. Your AWS account is always yours. Claria collects no telemetry and the developers never see any user data.
The responsibility: In a traditional SaaS arrangement, the vendor takes on compliance responsibility as a Business Associate. With Claria, you are both the Covered Entity and the operator of the infrastructure. This means:
The first step toward HIPAA-compliant AI is signing the AWS Business Associate Agreement. This is a free, one-time step in the AWS Console.
AWS offers a Business Associate Agreement at no extra cost. Once enrolled, the services Claria uses — S3, Bedrock, Transcribe, and CloudTrail — become HIPAA-eligible. No special pricing tier, no enterprise sales call.
After signing the BAA, download Claria and the setup wizard will walk you through the rest — creating your IAM user, configuring encryption, enabling audit logging, and setting up AI model access.