Key Architectural Outcomes & Takeaways
- ✓ End-to-end envelope encryption architecture for client medical records and Attending Physician Statements
- ✓ Automated ePHI de-identification pipeline scrubbing 18 HIPAA identifiers before LLM ingestion
- ✓ Audit trail retention using WORM (Write Once, Read Many) CloudTrail and S3 Object Lock storage
- ✓ Incident response runbook for potential data exposure notifications within the statutory 60-day HHS window
1. Compliance Scope & Threat Model
As an independent advisory firm handling health insurance applications, Medicare enrollments, and medical histories, AskTheHIM is a Covered Entity / Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and subject to the HIPAA Security Rule (45 CFR Part 164, Subpart C).
Our zero-trust architecture protects against three primary threat vectors:
- Unauthorized Exfiltration of ePHI: Interception of client medical records or application data.
- AI / RAG Pipeline Data Leakage: Inadvertent transmission of client PII/ePHI to third-party LLMs.
- Session Hijacking: Compromise of remote telehealth consultation streams.
2. Cryptographic Envelope Encryption Architecture
All client application files, uploaded laboratory tests, and underwriting documents are encrypted using Envelope Encryption (AES-256-GCM data encryption keys protected by AWS KMS root keys):
CODE
+--------------------------------------------------------------------------+
| AWS KMS Envelope Encryption Flow |
+--------------------------------------------------------------------------+
[ Client Document Upload ]
|
v
1. Ingestion service calls AWS KMS GenerateDataKey(AES_256)
|
+---> Returns: [ Plaintext DEK ] & [ Ciphertext Encrypted DEK ]
|
2. Service encrypts document body using [ Plaintext DEK ] (AES-256-GCM)
|
3. Plaintext DEK is cryptographically erased from memory
|
4. Encrypted Document + [ Ciphertext Encrypted DEK ] stored in Private Bucket
TYPESCRIPT
// src/services/security/envelope-crypto.ts
import crypto from 'crypto';
import { KMSClient, GenerateDataKeyCommand } from '@aws-sdk/client-kms';
const kms = new KMSClient({ region: 'us-east-1' });
export interface EncryptedPayload {
iv: string; // Base64
authTag: string; // Base64
ciphertext: string; // Base64
encryptedDataKey: string; // Base64
}
export async function encryptEphiDocument(
plaintextBuffer: Buffer,
kmsKeyId: string
): Promise<EncryptedPayload> {
// 1. Request Data Encryption Key (DEK) from KMS
const command = new GenerateDataKeyCommand({
KeyId: kmsKeyId,
KeySpec: 'AES_256'
});
const response = await kms.send(command);
if (!response.Plaintext || !response.CiphertextBlob) {
throw new Error('KMS DEK Generation Failed');
}
const plainDek = Buffer.from(response.Plaintext);
const encryptedDek = Buffer.from(response.CiphertextBlob).toString('base64');
// 2. Encrypt using AES-256-GCM
const iv = crypto.randomBytes(12); // 96-bit IV recommended for GCM
const cipher = crypto.createCipheriv('aes-256-gcm', plainDek, iv);
const encryptedBuffer = Buffer.concat([
cipher.update(plaintextBuffer),
cipher.final()
]);
const authTag = cipher.getAuthTag();
// 3. Securely overwrite plaintext DEK memory
plainDek.fill(0);
return {
iv: iv.toString('base64'),
authTag: authTag.toString('base64'),
ciphertext: encryptedBuffer.toString('base64'),
encryptedDataKey: encryptedDek
};
}3. The 18 HIPAA Safe Harbor Identifier Sanitization Pipeline
Before any unstructured text is forwarded to internal AI models or RAG indexers, it passes through an inline de-identification pipeline:
TYPESCRIPT
// src/services/security/hipaa-sanitizer.ts
export function scrubHipaaIdentifiers(rawText: string): string {
let cleaned = rawText;
// 1. Social Security Numbers (SSN)
cleaned = cleaned.replace(/\b(?!000)(?!666)[0-8]\d{2}[- ](?!00)\d{2}[- ](?!0000)\d{4}\b/g, '[REDACTED_SSN]');
// 2. Phone Numbers (US)
cleaned = cleaned.replace(/\b(\+?1[-.\s]?)?(\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g, '[REDACTED_PHONE]');
// 3. Email Addresses
cleaned = cleaned.replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g, '[REDACTED_EMAIL]');
// 4. Medicare Beneficiary Identifiers (MBI: 11 characters alphanumeric)
cleaned = cleaned.replace(/\b[1-9][A-Za-z][0-9A-Za-z][0-9A-Za-z]-[A-Za-z][0-9A-Za-z][0-9A-Za-z]-[0-9A-Za-z]{4}\b/g, '[REDACTED_MBI]');
// 5. Dates (except year alone)
cleaned = cleaned.replace(/\b(0?[1-9]|1[0-2])[\/.-](0?[1-9]|[12]\d|3[01])[\/.-](\d{2}|\d{4})\b/g, '[REDACTED_DATE]');
return cleaned;
}4. Immutable Audit Trail (WORM Storage)
HIPAA §164.312(b) mandates that access and administrative changes be recorded without possibility of alteration. We implement AWS S3 Object Lock in Compliance Mode:
- Retention Period: 7 years (2,555 days)
- Legal Hold: Enabled for active litigation or Department of Health and Human Services (HHS) inquiries
- Root Protection: Cannot be disabled, overridden, or deleted by any IAM user or AWS root account
5. Security Incident Response Protocol
In the event of an unauthorized access event or key exposure:
- Containment (T+0 to T+1 hour): Revoke KMS Data Keys, terminate active sessions via Okta, and isolate impacted VPC endpoints.
- Forensic Analysis (T+1 to T+24 hours): Ingest CloudTrail and VPC Flow Logs into Amazon Athena to determine exact records accessed.
- Breach Determination (T+24 to T+72 hours): Perform a 4-Factor Risk Assessment under HIPAA §164.402 to evaluate probability of ePHI compromise.
- HHS / Client Notification: If a breach is confirmed, notify impacted clients and HHS Office for Civil Rights (OCR) within statutory deadlines.
6. Audit Readiness Checklist
- Business Associate Agreements (BAAs) executed with AWS, Cloudflare, Twilio, and CRM providers.
- FIDO2 WebAuthn hardware security keys enforced for all advisor administrative logins.
- Quarterly external penetration tests conducted by independent CREST-certified auditors.
- Automated Daily KMS key usage anomaly alerts streaming to centralized SIEM.
Continuous Verification Protocol
This document was validated against current carrier API specifications, CMS guidelines, and IRS statutes as of November 1, 2026. Consultations with Charles Boyd are complimentary and independent.
