HIPAA-grade order layer, what’s actually required (encryption, BAA, audit log, purge policy)?

HIPAA isn’t a checkbox; it’s a posture. The non-negotiables for a Magento medical-supplies store:

• Encryption at rest, AES-256 on the customer + order + sales tables (specifically the columns holding PHI: patient name, DOB, SSN/MBI, insurance ID, diagnosis codes). Magento supports column-level encryption via the encryption interface; we extend it to PHI columns.
• Encryption in transit, TLS 1.2+ everywhere, HSTS on. No surprise.
• BAA-ready hosting, AWS HIPAA-eligible services (RDS, EC2, S3, CloudFront) under a signed BAA, Cloudways Pro+ tier with BAA, or Magento Commerce Cloud Pro. Most shared hosts (Bluehost, SiteGround, etc.) will not sign a BAA, not an option.
• Audit log, every PHI read/write logged with user, IP, action, before/after, timestamp. Magento has a basic admin action log; we extend it to capture API access + customer-account access.
• Customer-data auto-purge, per-state retention timers. CA 7yr, TX 7yr, FL 5yr, NY 6yr (per state DME regulations). Cron-driven purge on inactive accounts past the timer.
• Access controls, MFA on all admin accounts, role-based PHI access, 15-min session timeouts on admin, IP allowlisting on the admin panel.
• Breach response plan, written, tested, ready to fire within 60 days of detection (HIPAA breach-notification rule).

This is built into the platform from day one, not bolted on after launch. Migrating an existing Magento store to HIPAA posture mid-life is roughly 2x the cost of building it right the first time.