Does AWS Sign a HIPAA BAA?

Yes. Amazon Web Services signs a Business Associate Agreement at no cost, available through the AWS Artifact console. The BAA covers a defined list of HIPAA-eligible services — not all AWS services. Enabling a non-eligible service to touch PHI, even via logging, puts you in violation.

See the HIPAA BAA guide for the full vendor chain implications.

Core Eligible Services (2026)

Compute: EC2, Lambda, ECS, EKS, Fargate

Storage: S3, EBS, EFS, S3 Glacier

Database: RDS (all engines), DynamoDB, ElastiCache, Redshift, Aurora

Networking: VPC, Route 53, CloudFront, API Gateway, ALB/NLB

Security & Identity: IAM, KMS, Secrets Manager, CloudHSM, Cognito, Certificate Manager

Monitoring & Logging: CloudWatch (Logs, Metrics, Alarms), CloudTrail, Config, Security Hub, GuardDuty

Healthcare: AWS HealthLake (FHIR-native storage and querying)

What's Not Covered and Why It Trips Teams Up

Many AI/ML services — Bedrock, Rekognition, and some SageMaker features have specific BAA requirements; verify before processing PHI
Some email sending services — SES is eligible but requires configuration to prevent unencrypted PHI in email bodies
Third-party tools you install into your AWS environment (Datadog agents, logging sinks) are their own Business Associates — see the vendor chain audit process in the BAA guide

The Minimum HIPAA RDS Configuration

resource "aws_db_instance" "phi_database" {
  engine                          = "postgres"
  instance_class                  = "db.t3.medium"
  storage_encrypted               = true
  kms_key_id                      = aws_kms_key.phi.arn
  multi_az                        = true
  backup_retention_period         = 7
  deletion_protection             = true
  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]

  # No public access — private subnet only
  publicly_accessible    = false
  db_subnet_group_name   = aws_db_subnet_group.private.name
  vpc_security_group_ids = [aws_security_group.db_sg.id]
}

KMS encryption, private subnets, no public access, and CloudWatch logging enabled — these four configurations are the minimum for any PHI datastore. The full HIPAA engineering checklist covers the complete architecture across compute, storage, networking, and monitoring layers.

The HIPAA & SOC 2 Cloud Architecture service handles complete AWS HIPAA infrastructure — from BAA setup to Terraform modules for every layer.