Shared Responsibility Model
The split of security duties between a cloud provider and its customer; the cloud secures the infrastructure, the customer secures what runs on it.
The shared responsibility model is the split of security duties between a cloud provider and its customer. The provider secures the physical data centers, hardware, and core services. The customer secures everything built on top: operating systems, encryption settings, access rules, and logging. Our guide applies the model to each system a practice runs and shows who signs each BAA.
Under HIPAA, this split means a signed BAA with AWS, Azure, or Google Cloud is necessary but not sufficient. The safeguards at 45 CFR § 164.312 that fall on the customer side, such as access control and audit controls, are yours to set up. On AWS, PHI should stay inside the services on its HIPAA eligible services list. Eligible does not mean compliant. AWS says customers must still configure each service to meet HIPAA. See our HIPAA cloud hosting guide for how the split works in practice.
A managed host can take on part of the customer side of the shared responsibility model. Our HIPAA cloud hosting service runs on single-tenant AWS, and our BAA covers the servers and services we run. We sign it within 24 hours of signup, before patient data moves. Every plan includes encryption at rest and in transit, a web application firewall, six-year audit logging, and tested encrypted backups. Email, SMS, EHR, forms and AI model vendors that handle PHI need their own BAAs. Other HIPAA duties stay with you, such as security awareness training for your workforce (45 CFR § 164.308).