Healthcare and life sciences companies often have to adhere to specific regulatory requirements, such as GxP or HIPAA. The ability to treat your application environment as code on AWS lets you iterate faster while adhering to the appropriate regulatory frameworks. In this session, we discuss how DevOps principles can help you achieve your compliance requirements by validating your infrastructure in the same way that you do software. In particular, we discuss common compliance principles, demonstrate how to translate from policies to technical controls, and highlight how our partners are building for GxP and HIPAA.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
CONTINUOUS COMPLIANCE FOR
HEALTHCARE AND LIFE SCIENCES
A a r o n F r i e d m a n , P a r t n e r S o l u t i o n s A r c h i t e c t
C h r i s W h a l l e y , A P N C o m p l i a n c e L e a d
G P S T E C 3 0 6
N o v e m b e r 2 8 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud users in every industry
H e a l t h c a r e &
l i f e s c i e n c e s
E n t e r p r i s e N o n p r o f i t
G o v e r n m e n t E d u c a t i o n
E n e r g y
F i n a n c i a l
S e r v i c e s

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Healthcare & Life Sciences in the Cloud
Build
new cloud
applications
Migrate
existing
applications
Buy
cloud-ready
solutions
Get
help when
it’s needed

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Improve Your Compliance Posture with AWS
C o n t r o l l a b l e
i n f r a s t r u c t u r e
R e p e a t a b l e t e s t i n g A u t o m a t i c
t r a c e a b i l i t y
“ W e w o r k c l o s e l y w i t h A W S t o d e v e l o p a s e c u r i t y m o d e l , w h i c h w e
b e l i e v e e n a b l e s u s t o o p e r a t e m o r e s e c u r e l y i n t h e p u b l i c c l o u d
t h a n w e c a n i n o u r o w n d a t a c e n t e r s . ”
R o b A l e x a n d e r
C I O , C a p i t a l O n e

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Aligning to global frameworks

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
New HIPAA eligible service & features
2 0 1 3 2 0 1 4 2 0 1 5 2 0 1 6 2 0 1 7

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Controls in HCLS
Roles & authorities Data management Incident Response Approved tools
Hiring & training Risk management Breach response Auditing
Records management Change management Supplier management Regulatory inspections
System development
lifecycle
Environmental
health & safety
Electronic signatures Corrective actions
Application development Access controls Help desk Hardware & equipment
Application Testing Data integrity Disaster recovery

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of compliance controls
TECHNICAL CONTROLS
Controls for machines
Machine-readable policies
Automatically executed instructions
Testing & debugging required
Monitoring required
PROCEDURAL CONTROLS
Controls for humans
Human-readable policies
Manually executed procedures
Learning & training required
Monitoring required

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Control example: server installation
TRADITIONAL PROCEDURES CLOUD TECHNOLOGY

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Implications of Cloud
Adapt IT to business changes faster
Improve system reliability & performance
Assure better information security
Reduce IT development & operating costs
Continuous compliance & audit-readiness
As new cloud SDLCs emerge,
governance programs must stay current.

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud governance
The combination of te chnical and proce du ral
controls for assu ring that you r clou d solu tions alig n
with you r b u sine ss strate g y.
B U I L D M I G R A T E B U Y
For your
own use
For your
customers
Systems in
production
Legacy
applications
Marketplace
solutions
Partner
solutions

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Validate infrastructure as you would code
AWS
CloudFormation
AWS
CloudTrail
Amazon
CloudWatch
AWS
Config
AWS
CodeBuild
AWS
CodePipeline
Amazon
Inspector
1. Create CI/CD pipeline for infrastructure
2. Create and commit Cfn Templates
3. Run Unit Tests and build
4. Run Integration Tests
5. Manually approve changes
6. Deploy to production

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Services that enable compliance
AWS CloudTrail AWS Config Amazon
CloudWatch
Amazon EC2
Systems Manager
AWS IAM AWS
CloudFormation

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CloudTrail

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Config

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Config Rules Repository

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Let’s dive deeper…

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Control of records
Roles & authorities Data management Incident Response Approved tools
Hiring & training Risk management Breach response Auditing
Records management Change management Supplier management Regulatory inspections
System development
lifecycle
Environmental
health & safety
Electronic signatures Corrective actions
Application development Access controls Help desk Hardware & equipment
Application Testing Data integrity Disaster recovery

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Control of records: governance controls
Records
management
Technical controls
Procedural controls
Training
Policies & procedures
IAM Policies
Logs & tickets
Cfn/Config scripts

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Control of records: policy

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Control of records: version history

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Testing logging persistence
Test Type
CloudTrail enabled Managed Config Rule
CloudTrail writing to S3 bucket Custom Config Rule
Config Enabled Custom Config Rules Repo
Log Archival Policy Custom Config Rule
No-delete on S3 log bucket/logs Custom Config Rule
S3 logs enabled for all buckets Custom Config Rule
Goal: How do we e nsu re log s are writte n,
are n’t de le te d, and archive d?

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
And now… to the console!

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
It’s time for…
The Partner Lightning Round!

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Visualizing compliance

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Simplifying procedural controls

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Open source policies and procedures

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Continuous compliance philosophy

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Compliance guardrails

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
In Summary…
AWS helps you reinforce your security and compliance posture
Our APN Partners are raising the bar on compliance
For more information, visit: https://aws.amazon.com/health and
https://aws.amazon.com/compliance/

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
THANK YOU!