Is AWS HIPAA compliant?
Yes, if you accept the AWS business associate addendum in AWS Artifact and then keep patient data only inside the services on the HIPAA Eligible Services list.
Applies to AWS. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Accept the addendum before patient data touches AWS. AWS requires it before using eligible services for any purpose involving patient information.
- Accept it in AWS Artifact: Artifact console → Agreements → Account agreements (or Organization agreements) → select the addendum → Download → accept the Artifact NDA → review → Accept agreement.
- By default only users with administrative privileges can accept. IAM and federated users need explicit Artifact permissions.
- With AWS Organizations you can accept once for every account, and subsequent member accounts are automatically covered.
- Put patient data only in services on the HIPAA Eligible Services Reference. You may run any service in a HIPAA account, but only eligible ones may process it.
- Apply the security configuration the addendum requires and architect access control, logging and backup yourself under the shared responsibility model.
- Re-check the eligible services list before adopting any new AWS service.
Does AWS sign a business associate agreement?
Yes. Amazon Web Services offers one. No special plan or support tier. Self-service for any AWS account, or organization-wide via AWS Organizations. AWS Artifact console → Agreements → Account agreements → Business Associate Addendum → Download → accept the Artifact NDA → review → Accept agreement.
What this means in practice
For most readers this matters because a developer or a billing platform is building on AWS on your behalf. Accepting the addendum is genuinely simple: an administrator opens AWS Artifact, finds the business associate addendum under agreements, accepts the Artifact confidentiality terms and then accepts the addendum. If you run AWS Organizations you can accept once and have member accounts picked up automatically, which is the cleanest option when accounts multiply.
What takes discipline is the eligible services list. You may run anything you like in the account, but only services on that list may touch patient data, and the carve-outs inside otherwise-eligible services are where projects come unstuck. SageMaker excludes Studio Lab, Ground Truth Plus and the public and vendor workforces. CloudFront excludes Embedded Points of Presence. Pinpoint excludes voice messaging and the WhatsApp channel. RDS is eligible only for particular database engines, and some Bedrock foundation models are excluded even though the service itself qualifies.
The habit to build is a check against that list every single time somebody proposes adopting a new AWS service.
How organizations get this wrong
- Assuming an account is covered because a developer clicked through something once, without confirming the addendum shows as accepted in AWS Artifact.
- Reading a service name on the eligible list as blanket approval, when RDS qualifies only for specific engines and SageMaker carves out several components.
- Spinning up a new AWS service for a quick reporting job without re-checking the eligible services list first.
- Accepting on the main account while an older second account quietly holds backups outside any organization-wide acceptance.
What the agreement does not cover
- Any service not on the HIPAA Eligible Services Reference.
- Named carve-outs inside otherwise-eligible services, for example SageMaker AI excludes Studio Lab, Ground Truth Plus and the public and vendor workforces; CloudFront excludes Embedded Points of Presence; Amazon Pinpoint excludes voice messaging and the WhatsApp channel; Amazon RDS is eligible for specific engines only.
- Some Amazon Bedrock foundation models are excluded even though the service is eligible.
Alternatives
Equivalent cloud where the agreement applies by default through Microsoft's Data Protection Addendum
Comparable cloud with a click-through agreement and a published covered-products list
Keep a record of your AWS agreement
Sources
- HIPAA Compliance: Amazon Web Services. Read July 29, 2026.
- HIPAA Eligible Services Reference: Amazon Web Services. Read July 29, 2026.
- Managing agreements in AWS Artifact: Amazon Web Services. Read July 29, 2026.
Amazon Web Services can change these terms at any time. If something here no longer matches what Amazon Web Services tells you, tell us.