Is AWS HIPAA Compliant?

AWS is not independently “HIPAA compliant” for a customer’s workloads, but AWS can support HIPAA compliance when a HIPAA Covered Entity or Business Associate uses HIPAA-eligible AWS services under an executed AWS Business Associate Addendum and configures the environment to meet HIPAA requirements.

HIPAA compliance for systems hosted on AWS depends on the shared responsibility model. AWS is responsible for security of the underlying cloud infrastructure, while the customer is responsible for security in the cloud, including identity and access management, encryption configuration, logging, monitoring, incident response procedures, and workforce access controls.

A HIPAA Covered Entity or Business Associate should limit protected health information to HIPAA-eligible services covered by the AWS Business Associate Addendum and should implement administrative, physical, and technical safeguards that align with the HIPAA Security Rule. The customer also remains responsible for policies and procedures under the HIPAA Privacy Rule, including access controls that support the HIPAA Minimum Necessary Rule, and for breach assessment and notification processes under the HIPAA Breach Notification Rule.