HIPAA-Compliant Patient Data Encryption Pipeline

Design a Node.js microservice that securely encrypts and tokenizes patient medical records using AES-256-GCM encryption, with automatic key rotation every 30 days. Implement a robust key management system that integrates with AWS KMS, supports granular access controls, and provides comprehensive audit logging for compliance. The solution must handle PHI (Protected Health Information) for large healthcare providers, supporting concurrent encryption of multiple document types including PDF, XML, and JSON. Include comprehensive error handling that prevents data leakage and automatically quarantines compromised records.