We see the same pattern often among Korean-American doctors and dentists around Atlanta and the Duluth–Gwinnett County corridor — practices that opened with one provider, a front-desk PC running the EHR, and a hallway closet with a server and an imaging machine, and have since grown into a second location, an associate dentist or physician, and a growing patient list. What did not grow with the practice is a documented answer to where patient health information actually lives, who can reach it, and what happens if a laptop is stolen or a hard drive fails. For a medical or dental practice, that gap is not just an operational risk — it is a HIPAA compliance gap, and it is the first thing an OCR investigator or a malpractice attorney looks for after any kind of incident.
'HIPAA-compliant' is not a checkbox you tick once
Most Korean-American practice owners know the word HIPAA and know they signed something about it when they opened. Fewer have ever mapped out, in writing, exactly where patient data lives, who has access, and what safeguards protect it — which is precisely what the HIPAA Security Rule requires in practice: administrative safeguards (policies, training, designated responsibility), physical safeguards (who can physically reach the server or device), and technical safeguards (encryption, access controls, audit logs). A binder in a drawer that says 'we are HIPAA compliant' is not the same as an infrastructure that actually enforces those three categories every day. The gap between the two is exactly where a real audit, or a real breach, does the most damage.
Where PHI actually lives in a small practice — and it is rarely just the EHR
The places we most often find unmanaged PHI in growing Korean-American practices:
- Imaging and PACS files — dental X-rays, ultrasound, or scan images stored on a local server or an external drive, often with no encryption and no access log.
- Backup drives — a USB or NAS backup sitting in the same room as the server it backs up, which protects against nothing if the office floods, burns, or is broken into.
- Front-desk spreadsheets — billing, insurance, and appointment lists in Excel or Google Sheets, frequently shared over personal email or a consumer cloud account.
- Email attachments — referral letters, lab results, and images sent to specialists or labs over standard email, unencrypted, with no record of who received what.
- Patient reminder texts and a shared office phone or tablet — appointment and treatment details sent through consumer messaging apps with no audit trail.
- Departed staff access — a former hygienist, associate, or front-desk employee whose login to the scheduling or imaging system was never revoked.
What a HIPAA-compliant AWS setup actually includes
AWS offers a signed Business Associate Agreement and a defined set of services eligible for handling PHI once that agreement is in place. 'HIPAA-compliant AWS' is not a product you buy — it is a specific architecture built inside that framework, matched to how a medical or dental practice actually operates. Here is what that looks like in practice.
The concrete pieces of a HIPAA-appropriate AWS setup, and the problem each one solves:
- Business Associate Agreement (BAA) with AWS — the legal foundation required before any PHI touches AWS services; without it, nothing else here satisfies the Security Rule.
- Encryption at rest and in transit — imaging files, records, and backups are unreadable without the correct key, whether sitting in storage or moving between the office and the cloud.
- IAM (Identity and Access Management) with least-privilege access — each employee reaches only the systems their role requires, and access is revoked in one place the moment someone leaves.
- CloudTrail audit logging — a timestamped record of who accessed which patient data and when, which is exactly what an OCR investigator or a plaintiff's attorney asks for first after any incident.
- Automated encrypted backup with tested restore — imaging and records backed up on a schedule to a separate, encrypted location, with an actual restore test on record, not just an assumption that backups exist.
- Site-to-Site or Client VPN for multi-location practices — imaging and scheduling data moves between offices over an encrypted tunnel instead of consumer file-sharing tools.
- A written disaster-recovery and breach-notification plan — what happens, in order, if a device is lost, a server fails, or a breach is suspected, documented before it is needed rather than improvised during it.
The one question every practice should be able to answer today
Why this matters more around Atlanta–Duluth specifically
Gwinnett County and the wider Atlanta metro area are home to one of the largest and fastest-growing concentrations of Korean-American medical and dental practices in the country, clustered around Duluth, Suwanee, and Johns Creek. That density brings real advantages — referral networks, bilingual staff, patients who trust a Korean-speaking provider — but it also means practices here are more likely to be growing into a second location, hiring associates, or sharing imaging and referrals across a tight professional network, all of which multiply the number of places PHI can end up unmanaged. A single-provider practice with one server has a small, if real, exposure. A two-location practice sharing scheduling and imaging data between offices, with staff who have come and gone, has a meaningfully larger one — and a bilingual, HIPAA-literate partner who can walk through this in Korean or English, the same way a specialist would, tends to matter more here than in a market with fewer Korean-American practices to compare notes with.
How an audit and migration actually run
We start with a plain-language audit, not a sales pitch — where PHI actually lives today, across every device and account, who can reach it, what a former employee might still be able to access, and what the practice's honest risk profile looks like (a lost laptop, a ransomware attempt, an OCR complaint, a second-location rollout). From there we design the AWS architecture around that specific risk and migrate in phases: the new environment is built and tested alongside existing systems, then pieces move over one at a time — access control and backup first, since those close the most dangerous and most commonly cited gaps fastest, then imaging and multi-location connectivity. Staff keep working on current systems through most of that window, and any cutover is scheduled outside patient hours. Once migrated, the work does not stop — monitoring, patching, and periodic access reviews continue as an ongoing service, the same way we manage websites and infrastructure for our long-term clients.