Amazon Web Services (AWS): HIPAA status
Amazon's cloud platform. AWS signs a business associate agreement and publishes the list of services that may be used with PHI.
Signs a BAAYes
Amazon Web Services (AWS) signs a Business Associate Agreement. Requires an AWS business associate agreement; only services on the HIPAA eligible list may be used with PHI.
Source: AWS — HIPAA Eligible Services Reference · checked
Amazon Web Services (AWS) and HIPAA at a glance
Amazon Web Services (AWS) signs a Business Associate Agreement. A BAA alone does not make its use HIPAA compliant: you still need to put the AWS business associate agreement in place before storing or processing PHI, and use only HIPAA eligible services for PHI and configure them securely. Facts checked against AWS's own documentation on 2026-10-06.
| Signs a BAA | Yes |
|---|---|
| How you get it | Requires an AWS business associate agreement; only services on the HIPAA eligible list may be used with PHI. |
| You still need to | Put the AWS business associate agreement in place before storing or processing PHI. |
| Main limitation | Some services and features are excluded even when the service is listed — check the eligible list for exclusions. |
| Last checked | 2026-10-06 |
BAA details
| Signs a BAA | Yes | AWS — HIPAA Eligible Services Reference |
|---|
What you still have to configure
- Put the AWS business associate agreement in place before storing or processing PHI. source
- Use only HIPAA eligible services for PHI and configure them securely. source
Limitations
- Some services and features are excluded even when the service is listed — check the eligible list for exclusions. source
- Customers remain responsible for their own HIPAA compliance when using any AWS service. source
Against our criteria
| BAA without a sales process | Not verified | Not verified yet |
|---|---|---|
| Safeguards managed for you | No — Infrastructure: you configure security under the shared responsibility model. | AWS — HIPAA Eligible Services Reference |