Conditional As of 2026-10-19, AWS offers a BAA on every AWS account with no plan tiers, and the main exclusion is that any service not on the HIPAA Eligible Services Reference may not process or store ePHI. For hosting PHI, the accurate wording is "BAA available for HIPAA-eligible services," not "AWS is HIPAA compliant."
Short answer
You get the BAA by accepting the Business Associate Addendum online in AWS Artifact. It covers the services AWS publishes as HIPAA-eligible, including EC2, S3, RDS, DynamoDB, Lambda and Bedrock. Services outside that reference may not process or store ePHI, whether or not you have signed. AWS states that no HIPAA certification exists for a cloud service provider, so "HIPAA certified AWS" is not a real status. See the BAA and ePHI definitions for the terms, or browse all vendor HIPAA checks.
Which plans include a BAA
AWS has no plan tiers for the BAA. It is available to any account.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All AWS accounts (no plan tiers) | Yes | Accept in AWS Artifact, per account or once for all accounts in an AWS Organization | Not published by the vendor |
The facts list no excluded plans, so this page does not name any.
What the BAA covers and what it excludes
Covered:
- Amazon EC2
- Amazon S3
- Amazon RDS, including the SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines
- Amazon DynamoDB
- AWS Lambda
- Amazon Bedrock. AI questions are handled separately in Is AWS Bedrock HIPAA compliant?
- All other services listed on the HIPAA Eligible Services Reference
Excluded:
- AWS services not on the HIPAA Eligible Services Reference may not process or store ePHI.
A signed BAA does not make every AWS service a place for PHI. Picture a clinic's developer who has accepted the BAA and then adds a newly launched AWS service to a patient-intake app. If that service is not on the reference, the BAA does not cover it. Check the reference before each new service touches PHI. For storage and database options beyond AWS, see the hosting, databases, storage and software-development sections of the category directory linked below.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the sources checked for this page did not state it. It does not mean the control is absent.
How to use AWS with PHI
AWS runs on a shared-responsibility basis. The BAA covers the vendor's side. Configuration, access and policies are yours. For the wider program around a cloud workload, see the HIPAA guides.
- Accept the BAA in AWS Artifact before any PHI enters the account.
- Designate the account or accounts that will process PHI, or accept the BAA for the whole AWS Organization.
- Use only services on the HIPAA Eligible Services Reference for anything containing PHI.
- Check each new service against the reference before use, and again when a developer proposes swapping one.
- Configure access and security settings yourself. AWS does not publish default values for these in the sources checked.
- Keep written policies and train staff, including anyone with console access.
For a HIPAA-compliant AWS architecture, the rule is the same at any scale: BAA first, eligible services only. This page does not give reference designs, because none are in the sources checked. Compliance depends on the signed BAA, your configuration and your policies, not on the choice of AWS alone.
Alternatives with a BAA
All verdicts below are conditional. The HIPAA-compliant software by category directory compares them with other options.
- Atlantic.Net: BAA from the HIPAA Developer plan.
- Microsoft Azure: BAA for all customers under volume licensing or an online subscription.
- Backblaze: BAA for B2 Cloud Storage business customers.
- Box: BAA on Enterprise.
- Dropbox: BAA on Standard.
Sources
- HIPAA Compliance – Amazon Web Services (AWS) — BAA page, checked 2026-10-19. "To review, accept, and manage the status of the BAA for your account, sign in to AWS Artifact in the AWS Management Console."
- HIPAA Compliance – Amazon Web Services (AWS) — BAA page, checked 2026-10-19. "they should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services"
- HIPAA Compliance – Amazon Web Services (AWS) — BAA page, checked 2026-10-19. "There is no HIPAA certification for a cloud service provider (CSP) such as AWS."
- HIPAA Eligible Services Reference – Amazon Web Services (AWS) — Trust center, checked 2026-10-19. "without first entering into an AWS business associate agreement"
- HIPAA Eligible Services Reference – Amazon Web Services (AWS) — Trust center, checked 2026-10-19. "are eligible to create, receive, process, maintain, or transmit electronic protected health information (ePHI)"
- Managing agreements in AWS Artifact – AWS Artifact User Guide — Help article, checked 2026-10-19. "In the AWS Artifact console, you can review and accept such agreements, and you can designate an AWS account that can legally process PHI."
- Managing agreements in AWS Artifact – AWS Artifact User Guide — Help article, checked 2026-10-19. "If you use AWS Organizations, you can accept agreements, such as a BAA with AWS, on behalf of all AWS accounts in your organization."
- HITRUST CSF – Amazon Web Services (AWS) — Trust center, checked 2026-10-19. "AWS customers can inherit AWS HITRUST CSF certification provided that customers use only HITRUST-certified services."
- SOC FAQs – Amazon Web Services (AWS) — Trust center, checked 2026-10-19. "The AWS SOC 1 and SOC 2 are available to customers by using AWS Artifact"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.