Is AWS HIPAA Compliant? What the BAA Covers in 2026
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/is-aws-hipaa-compliant
Last updated: October 20, 2026
Is AWS HIPAA compliant? Not on its own. AWS is HIPAA eligible: Amazon will sign a Business Associate Addendum (BAA) and lets you build a compliant system on its infrastructure. But AWS does not make you HIPAA compliant by default. Under the AWS shared responsibility model, Amazon secures the underlying cloud while you remain responsible for how you configure everything you run on it. AWS lists 174 HIPAA eligible services as of its October 15, 2026 update. Under the AWS BAA, protected health information (PHI) should only be stored, processed, or transmitted in those services. Getting to compliance means signing the BAA, using only eligible services for PHI, and configuring encryption, access control, and logging yourself.
TL;DR: Quick answer
Is AWS HIPAA compliant? AWS is HIPAA eligible, not HIPAA compliant on its own. Amazon provides compliant building blocks; you are responsible for configuring them correctly.
Amazon will sign a Business Associate Addendum (BAA), its version of the Business Associate Agreement HIPAA requires (45 CFR § 164.308(b)). It must be in place before any PHI goes on AWS.
AWS lists 174 HIPAA eligible services as of its October 15, 2026 update. PHI must stay inside those services, and the list changes, so check it before each new use.
Under the shared responsibility model, AWS secures the cloud itself. You secure what you put in it: encryption, IAM, audit logging, and backups. HIPAA requires you to keep Security Rule documentation for six years, but it sets no retention period for the logs themselves.
Using AWS does not transfer your HIPAA obligations. Our managed plans run on single-tenant AWS from $229 a month, with a BAA signed within 24 hours of signup.
HIPAA eligible vs HIPAA compliant: the difference that matters
The question "is AWS HIPAA compliant" usually comes from a misread of two terms. HIPAA eligible means Amazon has built a service so it can be used with PHI and has agreed to cover it under a BAA. HIPAA compliant describes a whole system, including your configuration, policies, and staff, that meets the HIPAA Security Rule. AWS supplies eligible parts. Eligible does not mean compliant. AWS says customers must still configure each service to meet HIPAA. You assemble the parts into something compliant. No cloud provider can sell you compliance as a finished product, because compliance depends on choices only you control. For a startup, one of those choices is DIY AWS versus a managed host; our guide to HIPAA hosting for small businesses compares both.
Yes, AWS will sign a BAA (called a Business Associate Addendum)
HIPAA requires a signed agreement before any vendor stores or processes PHI for you, under 45 CFR § 164.308(b). Amazon meets this with the AWS Business Associate Addendum (BAA), which you accept through AWS Artifact in your account. The BAA defines how responsibility is split and which services are in scope. Until it is in place, putting PHI on AWS is a HIPAA violation, even if every technical control is set up correctly. The BAA is the legal foundation, not the encryption. Self-hosted EHRs are no exception: OpenEMR's AWS install includes executing a BAA with AWS, as our guide to HIPAA compliant EHR hosting explains. Amazon is not the only vendor you may need this answer from. How Heroku, Vercel, Render, Supabase, and other developer platforms handle the same BAA question, tier by tier, is laid out in HIPAA compliant app hosting. What any BAA must legally contain is covered in our HIPAA business associate agreement guide.
The shared responsibility model: who secures what
AWS describes security as a shared responsibility. Amazon is responsible for security "of" the cloud: the physical data centers, the hardware, and the core services. You are responsible for security "in" the cloud: your operating systems, your data, your access rules, and your network settings. For a wider view of how those safeguards map to the HIPAA Security Rule, see our complete guide to HIPAA compliant hosting. The short version: AWS hands you a secure foundation, but everything you configure on top of it is yours to get right.
For the wider view of running ePHI in the cloud, see how HIPAA cloud hosting works. If you build healthcare software on AWS, see HIPAA compliant hosting for healthcare SaaS. The same blast-radius thinking applies when a provider hosts many customers. See client-level isolation.
Only HIPAA eligible services can touch PHI
Amazon names every HIPAA eligible service in the AWS HIPAA Eligible Services Reference. It lists 174 services as of its October 15, 2026 update. For a service-by-service breakdown of the list and what each service still requires from you, see our guide to AWS HIPAA eligible services. Common building blocks are on the list: Amazon EC2 for servers, Amazon S3 for storage, and Amazon RDS and Aurora for databases. So are AWS Lambda for code, Amazon EBS for disks, AWS Key Management Service (KMS) for encryption keys, and AWS CloudTrail for logging.
AWS says services that are not on the list may run in a HIPAA account, as long as they do not process or store PHI. This trips up many teams, because a service can be popular and well secured and still be outside BAA scope. Part of the answer to "is AWS HIPAA compliant" for your setup sits in this list. Check the reference before you route PHI anywhere, since the list changes as Amazon adds services. AI services are on it too, including Amazon Bedrock. Where your chatbot, agents and model calls can run is covered in our guide to HIPAA compliant AI hosting. The database tier has its own rules; see HIPAA compliant database hosting.
What you must configure on the customer side
This is where "is AWS HIPAA compliant" turns into real work. The BAA and eligible services give you the materials. These controls turn them into a compliant system.
Encryption in transit and at rest
Encrypt data moving between systems with TLS 1.2 or higher, and encrypt stored data with AWS KMS, which commonly uses AES-256. HIPAA treats encryption as addressable under 45 CFR § 164.312(a)(2)(iv) and (e)(2)(ii), which means you use it or document an equal protection. In practice, encrypt everything.
Access control with IAM
Use AWS Identity and Access Management to give each person and service the least access they need, under 45 CFR § 164.312(a). Require multi-factor authentication on every account, avoid shared logins, and remove access promptly when someone leaves.
Audit logging and log retention
Turn on AWS CloudTrail and VPC Flow Logs so you can show who accessed data and when, under 45 CFR § 164.312(b). CloudTrail's event history covers only the past 90 days, so create a trail or event data store for an ongoing record. HIPAA's audit controls standard requires systems that record and examine activity, but it sets no retention period for the logs themselves. The six-year rule in 45 CFR § 164.316(b)(2)(i) covers Security Rule documentation. HIPAA requires you to keep that documentation for six years from when it was created or last in effect, whichever is later. Many organizations keep logs for six years to line up with the documentation rule.
Logging that is on but never reviewed is a common audit gap. Our audit log guide maps which logs your host should keep and which stay with your app, so you can name who reviews each one. How we handle it: every one of our managed plans includes six-year audit logging.
Backups and a recovery plan
If you build it yourself, keep encrypted, automatic backups and test that you can restore them. For more resilience, AWS Backup can also copy backups to a second AWS Region. HIPAA's contingency plan standard requires a data backup plan and a disaster recovery plan (45 CFR § 164.308(a)(7)). It is an administrative safeguard, not an optional extra. Texas providers should keep every copy in US Regions, because Texas SB 1188 requires US storage of health records. Under the Florida health data storage law, Canadian Regions also qualify, as do US Regions.
How we handle it: our plans include tested encrypted backups and EBS storage with 7-day snapshot retention. Each plan is one server in one AWS availability zone; a multi-zone design is quoted separately. The full checklist is in our guide to HIPAA backup and disaster recovery.
Common mistakes teams make on AWS
Three patterns show up again and again. The first is placing PHI in a service that is not HIPAA eligible because it was convenient. The second is treating the BAA as the finish line, when it is the starting line for configuration work. The third is leaving logging unmonitored, so a problem is only discovered after a breach. Each of these passes a casual look and fails a real assessment. This is why "is AWS HIPAA compliant" is the wrong question to stop on; the real question is whether your own setup is. Serverless teams have two extra traps, covered in is AWS Lambda HIPAA compliant.
If you would rather not build it yourself
Configuring HIPAA on AWS takes real expertise, and the gap between "eligible" and "compliant" is where most of the cost and risk lives. If your team would rather ship product than configure cloud servers, our managed HIPAA cloud hosting runs each plan on single-tenant AWS. Every plan includes:
Encryption at rest and in transit
A web application firewall and the CloudFront CDN
Six-year audit logging
Tested encrypted backups, plus EBS storage with 7-day snapshot retention
We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Email, SMS, forms and AI model vendors need their own BAAs. Plans start at $229 a month, with no long-term contract. Each plan includes 4 hours of migration and configuration, used in the first month. After that, work is $175 an hour, quoted before work starts.
HIPAA Compliant Hosting sells managed HIPAA hosting, so weigh our view with that in mind. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. We also think a team that understands the shared responsibility model makes safer choices, whoever runs its infrastructure.
If you are weighing the managed specialists against the DIY route, our comparison of HIPAA Vault alternatives lines up the main options. The monthly numbers for each route are in our guide to what HIPAA hosting costs. Moving an existing site? Our guide to migrating to HIPAA compliant hosting walks through each step.
Frequently asked questions
Is AWS HIPAA compliant?
AWS is HIPAA eligible, not HIPAA compliant on its own. Amazon signs a BAA and lists 174 HIPAA eligible services as of October 15, 2026. You are responsible for configuring encryption, access control, and logging so your full system meets the HIPAA Security Rule.
Does AWS sign a BAA?
Yes. Amazon offers the AWS Business Associate Addendum (BAA), which you accept in AWS Artifact. You must have it in place before storing or processing PHI on AWS.
Are Amazon S3 and RDS HIPAA eligible?
Yes. Amazon S3, Amazon RDS, and Amazon Aurora are on the AWS HIPAA Eligible Services Reference. You still must enable encryption, restrict access, and turn on logging for each one. The database-specific settings are in is Amazon RDS HIPAA compliant.
Does using AWS automatically make my app HIPAA compliant?
No. Eligible services and a signed BAA are necessary, not sufficient. Your configuration, policies, and a documented risk analysis determine whether your system is compliant.
How long should you keep AWS logs for HIPAA?
HIPAA sets no fixed retention period for audit logs. Its audit controls standard (45 CFR § 164.312(b)) requires systems that record and examine activity. HIPAA requires you to keep Security Rule documentation for six years (45 CFR § 164.316(b)(2)(i)), and many organizations keep logs that long too. CloudTrail's event history shows only the past 90 days, so set up a trail or event data store to keep more.
Is AWS HIPAA certified?
There is no official HIPAA certification from HHS, so no provider is "HIPAA certified." AWS demonstrates its controls through independent audits such as SOC 2 and ISO 27001, but HIPAA itself has no government certification. The full story on certification claims is in HIPAA certified hosting.
Recap: is AWS HIPAA compliant?
To recap, is AWS HIPAA compliant? AWS is HIPAA eligible, which is the foundation, not the finish. Sign the Business Associate Addendum and keep PHI inside the 174 HIPAA eligible services. Then configure encryption, IAM access control, audit logging with a documented retention period, and tested backups. Pair that with written policies and a documented risk analysis, and you can build a compliant system on AWS. Skip any of it and you have eligible infrastructure that still falls short.
If you would rather not work through "is AWS HIPAA compliant" server by server on your own, request a quote for managed hosting.
This article is general information, not legal advice. Regulatory details reflect the current HIPAA Security Rule (45 CFR Part 164), checked October 20, 2026. AWS details reflect its HIPAA Eligible Services Reference as updated October 15, 2026, and that list changes often. HHS proposed the first major Security Rule update since 2013 on January 6, 2025. It is still a proposal, and the federal regulatory agenda now targets a final rule in July 2027. Proposed requirements are not law yet; the current Security Rule still applies. Confirm your specific obligations with qualified legal counsel.
Sources
AWS: HIPAA Eligible Services Reference (last updated October 15, 2026)
AWS: HIPAA Compliance, the Business Associate Addendum and AWS Artifact
45 CFR § 164.308 (administrative safeguards, business associate contracts, contingency plan): law.cornell.edu
45 CFR § 164.312 (technical safeguards, audit controls, encryption): law.cornell.edu
45 CFR § 164.316 (documentation and its six-year time limit): law.cornell.edu
Federal Register: HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, January 6, 2025)
Reginfo.gov: Unified Agenda entry for RIN 0945-AA22