Based on the SAP-C02 exam guideReport an error
In 1996 the US Congress passed HIPAA (Health Insurance Portability and Accountability Act). Its original purpose was to let people keep their health insurance when changing jobs (portability), but the law's real legacy is its ancillary provisions, the Privacy Rule and Security Rule — the parts that prescribe how a patient's medical information (PHI) must be protected. In 2009 the HITECH Act strengthened this, sharply raising penalties for violations and making Business Associates such as cloud providers directly liable. That is why handling PHI on AWS has a signed BAA (Business Associate Addendum) as a legal precondition. This is why government and healthcare architecture differs from other domains — compliance limits the very choice of services.
Today is the last day of Week 15, and we do two things. First, we dig deeply into government and healthcare compliance (HIPAA, FedRAMP, GovCloud) from both the legal and technical angles. Second, we integrate the five cases covered in Week 15 (global ERP, startup, finance, media, healthcare) into one decision framework and train case-classification skills with 12 scenario questions. The essence of the Pro exam is instantly mapping "which case is this scenario, and which keyword points to which service."
The core of HIPAA is PHI (Protected Health Information) — any medical information that can identify an individual. The HIPAA Security Rule requires administrative, physical, and technical safeguards for PHI, and technically it specifies encryption in transit and at rest, access control, and audit logs.
The key to understanding HIPAA in the cloud is the Shared Responsibility Model and the BAA. AWS is responsible for the infrastructure (physical security, hypervisor), and the customer is responsible for the configuration on top of it (encryption settings, access control, PHI handling). The BAA is the contract that legally spells out this division of responsibility, and you obtain it from AWS Artifact. The decisive constraint is that PHI must be processed only in "HIPAA Eligible Services" — only about 130 AWS services fall within the BAA's scope. Putting PHI into a service that isn't HIPAA Eligible is a BAA violation. When the exam shows "block use of non-HIPAA-Eligible services," the answer is to Deny those services with an SCP — enforcing a legal requirement as a technical control.
One pillar of PHI protection is de-identification. HIPAA recognizes two de-identification methods — Safe Harbor (remove all 18 identifiers) and Expert Determination (a statistical expert certifies that the re-identification risk is low). On AWS, Comprehend Medical automatically extracts PHI entities (names, dates, diagnoses, etc.) from medical text to help with de-identification, and Macie automatically discovers PHI/PII stored in S3. The distinction between the two appears on the exam — "extract and de-identify PHI from medical text" = Comprehend Medical, "discover and classify sensitive data in S3" = Macie. Also, HealthLake is a data lake in the medical standard FHIR R4 format that structures and analyzes medical data.
⚠️ Trap: There is no such thing as a "HIPAA-certified Region" — HIPAA is managed by service (HIPAA Eligible) and the BAA, not by Region. You can legitimately handle PHI even in ordinary commercial Regions (us-east-1, etc.) with HIPAA Eligible services + a BAA. GovCloud is needed not because of HIPAA but because of government requirements like FedRAMP High and DoD. On the exam, if only HIPAA is present, an ordinary Region + Eligible services is sufficient, and if FedRAMP High/DoD is added, it moves to GovCloud — mixing these two up leads into the trap.
FedRAMP (Federal Risk and Authorization Management Program) is the security authorization program for the US federal government's use of cloud services, with Low, Moderate, and High impact levels. GovCloud (US) is a physically and logically isolated separate partition for these government requirements.
The key characteristic of GovCloud is personnel restriction for ITAR (International Traffic in Arms Regulations) and EAR compliance — GovCloud is operated and accessed only by US citizens and permanent residents, and it uses separate credentials, a separate console, and separate Regions (us-gov-west-1, us-gov-east-1). This is to satisfy the NIST SP 800-53 High baseline and the DoD SRG (IL2–5). The standard AWS partition (aws) and the GovCloud partition (aws-us-gov) differ starting from the partition identifier in the ARN, and IAM and accounts are completely separated. So there is no direct connection between ordinary Regions and GovCloud, and they must be managed separately. On the exam, when you see "FedRAMP High, DoD, US-citizen operation," it is GovCloud; for "FedRAMP Moderate," many services are already authorized in ordinary commercial Regions, so GovCloud may not be strictly necessary.
| Requirement | Sufficient environment |
|---|---|
| HIPAA only | Ordinary commercial Region + HIPAA Eligible services + BAA |
| FedRAMP Moderate | Ordinary commercial Region (many services authorized) |
| FedRAMP High / DoD IL4-5 | GovCloud (US) |
| ITAR (arms-related data) | GovCloud (US) (operated by US persons) |
Ultra-long-term WORM such as 30-year retention is solved by combining tiers — cheap storage with S3 Glacier Deep Archive (the cheapest archive tier), and immutability with Object Lock Compliance or Backup's Vault Lock Compliance. The two are orthogonal — Glacier handles "where to store it cheaply," and Object Lock handles "how to enforce immutability." When the exam shows "30 years, lowest cost, immutable," it is the combination of Glacier Deep Archive + Object Lock/Vault Lock Compliance.
In 2015, the US Office of Personnel Management (OPM) hack leaked the background-check records of about 21.5 million federal employees (including fingerprints and SF-86 security forms). The cause was years of inadequate security — the lack of multi-factor authentication, unencrypted data, legacy systems, and detection failures all compounded. This incident accelerated the strengthening of federal cloud security (mandatory FedRAMP, continuous monitoring). The lesson is the same as in healthcare and finance — compliance is not a checkbox but only meaningful when the entire defense-in-depth of encryption, MFA, segmentation, detection, and auditing is working. Government and medical scenarios on the exam always ask about this multi-layered protection simultaneously.
A Pro exam scenario is ultimately a game of first classifying "which case is this," and then choosing services that fit that case's driving constraint. We integrate the five Week 15 cases into one table.
| Case | Driving constraint | Signal keywords | Core services |
|---|---|---|---|
| Global ERP | Governance, networking, sovereignty | Multi-account, EU data, 100TB, hybrid | Organizations/SCP, TGW/DX, MGN, DMS+SCT, Aurora Global |
| Startup | Cost, speed, scale | Zero cost, fast launch, 100x, 3-person team | Lambda, DDB On-Demand, Aurora Serverless v2, Compute SP, OIDC |
| Finance | Isolation, encryption, auditing | PCI/SOX, HSM, CDE, RTO in minutes | CDE OU/SCP, CloudHSM/Custom Key Store, Inspection VPC, Vault Lock, Route 53 ARC |
| Media | Bandwidth, latency, DRM | Live, VOD, 5 million concurrent, 4K, DRM | MediaLive/Convert/Package/Connect, Origin Shield, Signed Cookie, Personalize |
| Healthcare/Government | Compliance constraints | HIPAA, BAA, FedRAMP, PHI, GovCloud | HIPAA Eligible+SCP, Macie/Comprehend Medical, HealthLake, GovCloud |
🎯 Scenario: "A single scenario presents 'PHI of 500 million records + FedRAMP High + 30-year retention + a live patient-monitoring stream' all at once. How do you break it down?" — Answer: recognize that the case is mixed and solve each constraint independently. PHI + FedRAMP High → GovCloud + HIPAA Eligible + BAA, 30 years → Glacier Deep Archive + Vault Lock Compliance, live stream → MediaLive/Connect (but check whether GovCloud supports them). The Pro exam's trap is to lure you into simplifying it to a single case — in reality, each constraint needs a different service. When you see "multiple constraints at once," separate them and map each one.
⚠️ Trap: The trap that repeats across every case is that "the strongest control is not automatically the answer." Recommending CloudHSM to a startup, or Multi-Site Active-Active for a generous RTO, is over-engineering. Pro thinking is the cheapest, simplest choice that exactly meets the requirement. Conversely, omitting isolation or encryption for cost reasons in finance or government is a compliance violation. You must first read what each case's driving constraint is, and then choose controls proportional to it.
In healthcare and government architecture, compliance limits the very choice of services — HIPAA Eligible + BAA + SCP confine PHI processing to legitimate services, FedRAMP High/DoD goes to GovCloud, PHI de-identification uses Comprehend Medical, discovery uses Macie, FHIR uses HealthLake, and 30-year WORM is solved with Glacier Deep Archive + Vault Lock Compliance. The insight of Week 15 as a whole is to classify a scenario into a case, choose controls proportional to the driving constraint, and break mixed constraints down independently.
Week 15 in one line: "Global ERP = governance/networking/MGN, startup = serverless/cost, finance = isolation/HSM/auditing, media = Elemental/CloudFront/DRM, healthcare/government = BAA/Eligible/GovCloud." Next week (Week 16) is a per-domain review + a final mock exam + D-Day strategy, training this case-classification skill in the real exam format.
Click a choice to reveal the answer and explanation.
Question 1
A health insurer processes PHI in an ordinary commercial Region (us-east-1) and wants to block, at the organization level and at the source, PHI from entering services that are not HIPAA Eligible. What is the most suitable control?
Question 2
You want to automatically extract PHI such as patient names and diagnoses from medical clinical notes (free text) and de-identify it. What is the most suitable service?
Question 3
A government agency must meet FedRAMP High and DoD IL5, and its systems must be operated only by US citizens (including ITAR-related data). What is the most suitable environment?
Question 4
You want to build a data lake that stores and analyzes PHI in the medical interoperability standard (FHIR R4) format. What is the most suitable service?
Question 5
You want to store transaction logs for 30 years at the lowest cost, and no one (including root) may modify or delete them. What is the most suitable combination?
Question 6
A global OTT streams live sports. It must have no downtime even if an encoder fails, and must securely receive camera feeds over the public internet. What is the combination for the input-to-encoding segment?
Question 7
A seed-stage SaaS needs a relational DB, but traffic is often zero and sometimes spikes suddenly. It wants cost proportional to usage and seamless scaling. What is the most suitable choice?
Question 8
A global manufacturer wants to enforce that EU workload data cannot leave to Regions outside the EU. Even the account root must not be able to create resources in non-EU Regions. What is the most suitable control?
Question 9
A bank must inspect all VPC-to-VPC and internet traffic centrally with IDS/IPS and TLS Inspection. What is the most suitable pattern?
Question 10
A financial firm wants to inject intentional failures every quarter to prove its DR meets its RTO/RPO, and to run this on an automatic schedule. What is the most suitable combination?
Question 11
A startup has grown 100x and its Lambda and Fargate costs are now tens of thousands of dollars per month. It wants a commitment discount while staying serverless, and also wants flexibility to change Regions and families. What is the most suitable option?
Question 12
One scenario presents "PHI processing + FedRAMP High + 30-year WORM retention + a global live patient-monitoring stream" all at once. What is the most correct approach?