A
BAA availableIs AWS HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
AWS offers a BAA that customers review and accept in AWS Artifact, and PHI should be handled only in services listed as HIPAA eligible. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access.
| Plan or product | BAA |
|---|---|
| AWS accounts that accepted the BAA in AWS Artifact | Covered |
| Member accounts covered when an organization’s management account accepts it | Covered |
What the BAA leaves out
- Services not on the HIPAA Eligible Services Reference should not process, store or transmit PHI
- Features of eligible services that AWS specifically excludes; generally available features are otherwise treated as eligible
How to get the BAA
Sign in to AWS Artifact in the AWS Management Console and review and accept the BAA; users without access ask an administrator for an IAM account with Artifact permissions.
What the vendor says to do
- Sign in to AWS Artifact in the Management Console and accept the BAA for the account
- Keep PHI only in services listed as HIPAA eligible
- Configure controls under the shared responsibility model
Proof from the vendor
- HIPAA Compliance: Amazon Web ServicesBAA via AWS Artifact, eligible services only, no HIPAA certification for cloud providers
- HIPAA Eligible Services ReferenceBAA required before PHI; generally available features eligible unless excluded
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.