Is Amazon RDS HIPAA Eligible? What AWS Eligibility Means and What It Leaves to You

Short answer: yes. Amazon RDS (SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines) and Amazon Aurora are on AWS's HIPAA Eligible Services Reference. Eligible means you may store PHI in them once your account has accepted the AWS BAA; it does not configure encryption, network isolation or logging for you. For the full list of AWS, Google Cloud and Azure services under each provider's BAA, search the HIPAA-eligible services lookup.

Does AWS Sign a HIPAA BAA?

Yes. Amazon Web Services signs a Business Associate Agreement at no cost, available through the AWS Artifact console. The BAA covers a defined list of HIPAA-eligible services — not all AWS services. Enabling a non-eligible service to touch PHI, even via logging, puts you in violation.

See the HIPAA BAA guide for the full vendor chain implications.

Core Eligible Services (2026)

These are the services most healthcare builds use. The HIPAA-eligible services lookup has every entry on the AWS list.

Compute: EC2, Lambda, ECS, EKS, Fargate

Storage: S3, EBS, EFS, S3 Glacier

Database: Amazon RDS (SQL Server, MySQL, Oracle, PostgreSQL, Db2, and MariaDB engines), Amazon Aurora, DynamoDB, ElastiCache, Redshift

Networking: VPC, Route 53, CloudFront, API Gateway, ALB/NLB

Security & Identity: IAM, KMS, Secrets Manager, CloudHSM, Cognito, Certificate Manager

Monitoring & Logging: CloudWatch (Logs, Metrics, Alarms), CloudTrail, Config, Security Hub, GuardDuty

Healthcare: AWS HealthLake (FHIR-native storage and querying)

AI/ML: Amazon Bedrock, Amazon Rekognition, Amazon SageMaker AI (excluding Studio Lab, Ground Truth Plus, and public or vendor workforces)

Last verified against the AWS reference: Sep 3, 2026. Source: AWS HIPAA Eligible Services Reference. Last reviewed 2026-09-25.

What's Not Covered and Why It Trips Teams Up

• Excluded features inside eligible services — for SageMaker AI, Studio Lab, Ground Truth Plus, and public or vendor workforces are excluded. Eligibility is per service and feature, and a new service is not covered until AWS adds it to the reference
• Some email sending services — SES is eligible but requires configuration to prevent unencrypted PHI in email bodies
• Third-party tools you install into your AWS environment (Datadog agents, logging sinks) are their own Business Associates — see the vendor chain audit process in the BAA guide

The Minimum HIPAA RDS Configuration

resource "aws_db_instance" "phi_database" {
  engine                          = "postgres"
  instance_class                  = "db.t3.medium"
  storage_encrypted               = true
  kms_key_id                      = aws_kms_key.phi.arn
  multi_az                        = true
  backup_retention_period         = 7
  deletion_protection             = true
  enabled_cloudwatch_logs_exports = ["postgresql", "upgrade"]

  # No public access — private subnet only
  publicly_accessible    = false
  db_subnet_group_name   = aws_db_subnet_group.private.name
  vpc_security_group_ids = [aws_security_group.db_sg.id]
}

KMS encryption, private subnets, no public access, and CloudWatch logging enabled — these four configurations are the minimum for any PHI datastore. The full HIPAA engineering checklist covers the complete architecture across compute, storage, networking, and monitoring layers.

The HIPAA & SOC 2 Architecture for Healthcare SaaS service handles complete AWS HIPAA infrastructure — from BAA setup to Terraform modules for every layer.