AWS HIPAA Compliance: eligible services, BAA, and architecture

A HIPAA-compliant AWS environment lets healthcare providers, SaaS companies, and other organizations that handle Protected Health Information (PHI) meet their security and regulatory obligations. AWS offers HIPAA-eligible services and security tools for storing, processing, and transmitting PHI under federal regulations.

AWS itself is not HIPAA-certified. It provides the infrastructure and security controls that compliance depends on, and the customer configures the services and puts the technical, administrative, and physical safeguards around PHI.

What does AWS HIPAA compliance mean?

Being AWS HIPAA compliant means running AWS services in line with HIPAA so that electronic Protected Health Information (ePHI) stays protected.

AWS gives you a secure cloud infrastructure and a set of HIPAA-eligible services. The security configuration and the administrative policies are yours to put in place, and full compliance depends on getting them right.

AWS and the shared responsibility model for HIPAA

The Shared Responsibility Model sets out who secures which part of the cloud environment:

• AWS's responsibility AWS secures the underlying cloud infrastructure: data centers, networking, and physical security.
• Customer's responsibility The organization using AWS configures services correctly, sets up access controls, encrypts PHI, and watches for security threats.

What the AWS Business Associate Agreement (BAA) does

Any organization handling PHI in AWS has to sign an AWS Business Associate Agreement (BAA). The BAA commits AWS to protecting the underlying infrastructure to HIPAA standards.

Signing a BAA does not make an organization HIPAA compliant on its own. You still have to configure your AWS services to meet the security and privacy requirements.

AWS gives you the tools for HIPAA compliance, and the legal and technical work stays with you. For how to configure your infrastructure for strict healthcare compliance, see our technical implementation guide.

Key requirements for AWS HIPAA compliance

AWS HIPAA compliance comes down to applying the security, privacy, and technical safeguards that HIPAA calls for. It starts with a signed BAA, which we cover in detail below, then rests on using only HIPAA-eligible services and configuring them so that electronic Protected Health Information (ePHI) stays protected. That configuration is the customer's job.

AWS HIPAA-eligible services

AWS keeps a formal list of HIPAA-eligible services: the ones cleared to store, process, or transmit PHI once your BAA is signed. It runs past 200 services and AWS adds to it as new services qualify, so the official reference is the source to trust for the full list. The services healthcare teams reach for most:

Amazon RDS and Aurora cover PHI in managed relational databases. Amazon Connect brings it to patient contact centers, and Amazon Bedrock lets you build AI features against clinical data without it leaving your BAA boundary. The data stays PHI in every case, so encryption and access controls travel with it.

Knowing the AWS compliance requirements is only part of the picture.

Organizations also need administrative and operational safeguards to reach full HIPAA compliance. Our guide on how to become HIPAA compliant goes into that.

How to build a HIPAA-compliant AWS architecture

A HIPAA-compliant AWS environment needs secure cloud configurations, encryption, and continuous monitoring.

You can configure AWS services by hand, but deploying a pre-configured Landing Zone built for HIPAA compliance gets you there with less risk of misconfiguration.

Solutions like our HIPAA-Compliant Environment handle this with Infrastructure-as-Code, AWS Security Hub, GuardDuty, and AWS Config to automate compliance enforcement and risk management. Security and compliance work together once PHI is involved in AWS: strict IAM policies tighten access, automated failover cuts downtime risk, and AWS-native tools like GuardDuty and Security Hub keep compliance monitoring running. See how rXperius modernized its cloud infrastructure to meet HIPAA standards and harden its security at the same time.

How to sign an AWS Business Associate Agreement (BAA)

A Business Associate Agreement (BAA) is a mandatory legal contract between AWS and any organization handling Protected Health Information (PHI).

It sets out AWS's responsibilities for protecting the underlying cloud infrastructure. The customer stays responsible for security configurations, access controls, and ongoing compliance management.

Without a BAA in place, an organization cannot store, process, or transmit PHI in AWS under HIPAA.

Steps to sign an AWS BAA

Signing a BAA with AWS is straightforward:

• 1. Review AWS's HIPAA compliance program Before signing, make sure your organization understands AWS's shared responsibility model and uses only HIPAA-eligible AWS services.
• 2. Access the AWS BAA agreement AWS provides the BAA through the AWS Artifact portal, where customers review and accept it.
• 3. Implement security controls Once the BAA is signed, configure your AWS environments to HIPAA requirements, with encryption, access control, and monitoring in place.

Running regular HIPAA compliance audits in AWS

Regular audits confirm that HIPAA controls stay enforced and surface security risks before they become incidents. Organizations should run internal compliance reviews at least once a year and keep detailed logs for regulatory reporting.

AWS Security Hub, GuardDuty, and CloudTrail let you catch drift in your security controls early, which lowers the chance of a data breach or a compliance gap. See how one healthcare platform used AWS-native security automation to strengthen its compliance posture and operational resilience in this success story.

Backups belong in that same review. A recovery point that has never been restored is an assumption rather than a control, and scheduled restore testing on AWS Backup produces the timestamped evidence an auditor will ask for.

Closing thoughts

AWS HIPAA compliance is more than signing a BAA. It rests on strong access controls, continuous monitoring, and automated compliance checks. With the right AWS security tools in place, a business can detect threats in real time and hold compliance as it grows.

We help organizations deploy pre-configured landing zones, put security automation in place, and run their compliance audits. If you want a setup that keeps your workloads secure and aligned with HIPAA, drop us a message.