Amazon Bedrock: HIPAA status
AWS's managed service for foundation models. Bedrock is on AWS's list of HIPAA eligible services, usable with PHI once you have an AWS business associate agreement.
Signs a BAAYes
Amazon Bedrock signs a Business Associate Agreement. HIPAA eligible; requires an AWS business associate agreement before using it with PHI.
Source: AWS — HIPAA Eligible Services Reference · checked
Amazon Bedrock and HIPAA at a glance
Amazon Bedrock signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you still need to enter into the AWS business associate agreement before using Bedrock with PHI, and use only services on the HIPAA eligible list for PHI. Facts checked against AWS's own documentation on 2026-10-06.
| Signs a BAA | Yes |
|---|---|
| How you get it | HIPAA eligible; requires an AWS business associate agreement before using it with PHI. |
| You still need to | Enter into the AWS business associate agreement before using Bedrock with PHI. |
| Main limitation | Customers remain responsible for their own HIPAA compliance when using any AWS service. |
| Last checked | 2026-10-06 |
BAA details
| Signs a BAA | Yes | AWS — HIPAA Eligible Services Reference |
|---|
What you still have to configure
- Enter into the AWS business associate agreement before using Bedrock with PHI. source
- Use only services on the HIPAA eligible list for PHI. source
Limitations
- Customers remain responsible for their own HIPAA compliance when using any AWS service. source
Against our criteria
| BAA without a sales process | Not verified | Not verified yet |
|---|---|---|
| Covers a ready-to-use chat app | Partial — Bedrock is an API; Amazon Q Business, a separate assistant, is also on the eligible list. | AWS — HIPAA Eligible Services Reference |