Is AWS HIPAA compliant? BAA, plans and safe use

Short answer: the AWS BAA, from AWS's own documentation

AWS also notes that no certification program for HIPAA exists for cloud providers. Nobody, AWS included, can hand you a "HIPAA compliant" badge for an account. What you get is a contract and a list of eligible services.

What HIPAA requires before patient information goes in

Under 45 CFR 164.502(e) (opens in a new tab), a covered entity may let a business associate "create, receive, maintain, or transmit protected health information on its behalf" only with "satisfactory assurance," documented in a contract that meets 45 CFR 164.504(e) (opens in a new tab). Our guide to business associate agreements explains each required clause.

The same section covers chains of vendors. A business associate may let a subcontractor handle PHI if it gets the same written assurances from that subcontractor. That's the usual position of AWS for a medical practice: your web developer, agency or software vendor is your business associate, and AWS is theirs. Our page on subcontractors walks through it.

Your website may already be sending patient details somewhere you haven't mapped. The free marketing audit flags privacy risks such as ad pixels on patient forms, from public information only.

Which AWS plans a BAA can cover

AWS has no "HIPAA plan." The BAA attaches to accounts:

1. One account. Accept the BAA under the Account agreements tab in AWS Artifact. AWS's Artifact guide (opens in a new tab) says this lets you "designate an AWS account that can legally process PHI."
2. A whole organization. From the management account, accept it for every account in your AWS Organization. "All existing and subsequent member accounts are automatically covered."
3. Termination. You can terminate the agreement in Artifact and reactivate it later.

The Artifact FAQ (opens in a new tab) adds two cautions: "Accounts that do not meet the definition of a HIPAA Account are not subject to the AWS BAA," and "You should always review any agreement terms with your legal, privacy and/or compliance teams before accepting." None of the AWS pages we read tie the BAA to a support plan or a minimum spend.

HIPAA-eligible services and shared responsibility

AWS's shared responsibility model (opens in a new tab) splits the work. AWS "is responsible for protecting the infrastructure that runs all of the services offered in the AWS Cloud." Your side "will be determined by the AWS Cloud services that a customer selects," and it includes the guest operating system, application software, firewall rules, permissions, and "managing their data (including encryption options)."

What the eligible list means for common practice setups, as of October 22, 2026:

Eligible doesn't mean safe by default. An S3 bucket of intake PDFs left public, or a database with no encryption at rest, sits on an eligible service and is still a breach waiting to happen. The list changes, so re-check it before any new build.

Safe uses and unsafe uses for a practice

Safe with no BAA: a brochure website with no forms, chat or uploads; marketing images; analytics built only on aggregate counts.

Appropriate with the BAA accepted and eligible services configured: a patient portal or intake app built on eligible services with encryption, logging and least-privilege access; form submissions stored in an encrypted database on an eligible service.

Unsafe: a contact or appointment form on a Lightsail-hosted WordPress site emailing or storing patient details; PHI in any account where nobody accepted the BAA; a developer's personal AWS account holding your patients' data with no BAA between you and the developer.

Safer setup or alternatives

Questions to put to whoever runs your website or app:

1. Whose AWS account holds our data, and has that account accepted the BAA in Artifact? Ask for a screenshot.
2. Which services touch patient data, and are they all on the current eligible list?
3. Is data encrypted at rest and in transit, and who has access?
4. Have you signed a BAA with our practice?

The same questions apply if your developer prefers Google Cloud (opens in a new tab) or Microsoft Azure (opens in a new tab). Both offer BAAs for covered services, and both leave your own compliance and configuration to you.

If the answers are vague, read our guide to HIPAA-ready website hosting before your next renewal. The HIPAA and marketing software hub covers other tools.

Medfy doesn't resell AWS. Its base plan rebuilds and hosts the practice's website on the practice's own domain, with HIPAA-compliant forms whose submissions go to separate, encrypted HIPAA databases in the US or Canada. Medfy signs a BAA with each practice before any patient data flows. See how Medfy handles patient data.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Will AWS sign a BAA?

Yes. AWS offers a Business Associate Addendum that you review and accept in AWS Artifact, inside the AWS Management Console, either for one account or, from a management account, for every account in an AWS Organization. Accepting it designates the account for PHI, but only in services on AWS's HIPAA Eligible Services list, which AWS last updated October 15, 2026. Verified October 2026.

Is the free version of AWS HIPAA compliant?

AWS's HIPAA pages don't tie the BAA to a paid plan or support tier; it's accepted per account in AWS Artifact. What decides eligibility is the service, not the price: PHI may go only into HIPAA-eligible services, and you must configure them yourself. A Free Tier account running a non-eligible service, or an eligible one left unencrypted, isn't a compliant setup.

Can a practice use AWS without patient information?

Yes. Hosting a brochure website, storing marketing images or running analytics on aggregate numbers involves no PHI, so no BAA is needed. The line is crossed the moment a contact or appointment form, upload or chat on that site sends patient details into AWS. At that point the account needs the BAA, eligible services and a configuration someone has checked.

What is a HIPAA-compliant alternative to AWS?

Google Cloud and Microsoft Azure also offer BAAs for covered services, and both say the customer remains responsible for its own compliance and configuration. For most independent practices, the bigger question is who runs the account. A managed platform that signs a BAA with your practice and handles the configuration can be safer than an AWS account nobody on staff can audit.