Does a HIPAA-Compliant Serverless Application Need a VPC for Lambda?

The decision should start with the services the function needs to reach. If Lambda only calls managed services through supported APIs and does not need access to private databases or internal systems, leaving it outside a VPC can reduce operational complexity. If you place it in a VPC, plan the endpoint and egress design carefully so the function does not lose access to AWS APIs or become dependent on a poorly configured NAT path. Tools such as cdk-nag can help identify missing security controls and document accepted exceptions for an audit.

Tenant isolation in Lambda is a separate concept from VPC networking and should not be treated as a replacement for every network control. VPC endpoints may help demonstrate that application traffic uses private connectivity, even though traffic to AWS services is already carried across AWS infrastructure. Ultimately, confirm that every service handling protected health information is eligible under your agreement and validate the design with your compliance team or auditor rather than assuming a VPC alone settles the question.

For some organizations, especially large healthcare customers, a VPC makes security reviews easier because they expect to see security groups, private endpoints, and explicit network controls. Reviewers may also ask for firewall or endpoint-detection controls that do not map neatly to Lambda. That is an approval and governance concern, though—not proof that Lambda outside a VPC is inherently unsafe. In some cases teams choose ECS on Fargate simply because it fits the customer's checklist better.

There usually isn't much technical benefit to putting Lambda in a VPC for this architecture, but there may be an audit and customer-approval benefit. A VPC is not what makes the application HIPAA compliant; your covered services, agreements, IAM policies, encryption, logging, monitoring, incident response, and documented controls matter more. If you do use a VPC, remember that you also inherit responsibility for routing, endpoints, NAT, security groups, and maintaining that network configuration.

A Lambda function configured for VPC access is not literally running inside your AWS account's VPC. Lambda creates managed Hyperplane network interfaces that bridge the function to your VPC. Also, AWS service traffic from AWS-hosted compute generally stays on AWS's network even when public service endpoints are used. VPC endpoints can still be useful for enforcing private access and producing a clearer network-control story, but they are not automatically required for HIPAA.