Opexia - Healthcare Software Engineering & EHR Integration

Practical reference

AWS vs Google Cloud vs Azure for Healthcare Software

Last verified 2026-09-26. Vendor terms and prices change; every row links to its source.

All three major clouds will sign a HIPAA Business Associate Agreement with you, and none charges extra for it. AWS and Google Cloud let you accept it in the console; Microsoft includes it in the standard Azure licensing terms.

The differences that matter for a healthcare build are narrower: how many services the BAA covers and how that list is published, how you get compliance evidence for a security review, how cleanly managed PostgreSQL, customer-managed keys and audit logging fit together, and how the bill is structured. In practice the choice usually follows the cloud your team already knows and the AI services you need to run on PHI.

Side-by-side comparison

AWS:
“HIPAA eligible” is the provider’s own term for a service you may use with PHI under its BAA.
Google Cloud:
“covered product” is the provider’s own term for a service you may use with PHI under its BAA.
Azure:
“in HIPAA BAA scope” is the provider’s own term for a service you may use with PHI under its BAA.
[1], [2]:
links to the provider’s own page backing that cell.
Contract and evidence
FactorAWSGoogle CloudAzureWhy it matters in healthcare
How you get the BAASelf-serve in AWS Artifact: accept it for one account, or from the management account for every account in an AWS Organization. [1]Self-serve on the console's IAM & Admin privacy page: Review and Accept. Opting in from one project covers every project in the account. [1]Nothing to sign. The HIPAA BAA is included by default in the Microsoft Product Terms and Data Protection Addendum for covered entities and business associates. [1]You need the BAA in place before the first real patient record reaches the cloud, including in staging if it ever holds a copy of production data.
What the BAA costsNo charge. AWS provides Artifact documents and agreements free of charge. [1]No additional cost. Google states HIPAA customers get the same products at the same pricing as everyone else. [1]No separate fee. The BAA is part of the standard licensing terms that come with an Azure subscription. [1]A HIPAA surcharge would change the budget for a small practice or startup. None of the three adds one, so compare the services you run, not the paperwork.
How covered services are publishedPublic web page, the HIPAA Eligible Services Reference. 174 services counted on 2026-09-26 (page updated 2026-09-03). [1]Public web page, the Covered Products list on the HIPAA page. 146 products counted on 2026-09-26 (page updated 2026-09-17). [1]A document, not a web page: Appendix A of Azure Compliance Offerings on the Service Trust Portal. 195 services marked HIPAA BAA, counted 2026-09-26. [1][2]Counts aren't directly comparable because each provider groups products differently. What matters is whether every service that touches PHI is on the list.
Compliance evidence for security reviewsAWS Artifact: SOC, ISO and PCI reports plus agreements, downloaded self-serve from the console at no charge. [1]Compliance Reports Manager: ISO certificates, SOC reports and HIPAA mapping at no additional cost. Some items need a Google Cloud sign-in. [1]Service Trust Portal: audit reports and whitepapers. Some need sign-in with a Microsoft Entra work account and acceptance of an NDA. [1]Hospital and payer security questionnaires ask for your cloud provider's SOC 2 report. Knowing where to download it saves days in a vendor review.
Core services for PHI
FactorAWSGoogle CloudAzureWhy it matters in healthcare
Managed PostgreSQLAmazon RDS for PostgreSQL and Amazon Aurora. Both are on the eligible list (RDS for the listed engines, which include PostgreSQL). [1][2]Cloud SQL for PostgreSQL and AlloyDB for PostgreSQL. Both are on the covered list. [1][2]Azure Database for PostgreSQL (flexible server). Marked HIPAA BAA in Appendix A, and its own compliance page lists HIPAA and HITECH. [1][2]Most care-management and clinical-ops systems are relational. A managed, covered Postgres gives you encryption, backups and point-in-time restore without running a database server yourself.
Customer-managed encryption keysAWS KMS customer managed keys. KMS and CloudHSM are both on the eligible list. [1][2]Cloud KMS with customer-managed encryption keys (CMEK). Cloud KMS and Cloud HSM are both on the covered list. [1][2]Azure Key Vault, which includes Managed HSM. Marked HIPAA BAA in Appendix A. [1][2]Your own keys let you show an auditor who can decrypt PHI, rotate on a schedule, and revoke access to data without deleting it.
Audit loggingAWS CloudTrail (eligible). Event history keeps 90 days of management events; keeping more needs a trail to S3 or CloudTrail Lake. [1][2]Cloud Audit Logs in Cloud Logging (covered). Admin Activity logs are always on; Data Access logs are off by default except for BigQuery. [1][2]Azure Monitor (in scope). The activity log is on by default and kept 90 days; data-plane resource logs need a diagnostic setting. [1][2]HIPAA expects you to record and review who accessed PHI. Each cloud's default misses data-access events or long retention, so switch both on before launch.
Private networkingAmazon VPC is on the eligible list. AWS PrivateLink (private connections from your VPC to services) is not listed as a separate service. [1][2]Virtual Private Cloud and VPC Service Controls (service perimeters around Google APIs). Both are on the covered list. [1][2]Virtual Network and Azure Private Link (private endpoints for PaaS services). Both marked HIPAA BAA in Appendix A. [1][2]Keeping the database and storage off the public internet shrinks the attack surface. It is also the first thing a hospital security reviewer asks about.
Object storageAmazon S3 and S3 Glacier. Both on the eligible list. [1]Cloud Storage. On the covered list. [1]Blob Storage, including Data Lake Storage Gen2. Marked HIPAA BAA in Appendix A. [1]Scanned referrals, consent forms, exports and backups all end up as files. They hold PHI just as much as the database does.
Serverless and containersAWS Lambda, Amazon ECS, Amazon EKS and AWS Fargate (Fargate for the ECS and EKS engines only). All on the eligible list. [1]Cloud Run, Cloud Run functions and Google Kubernetes Engine. All on the covered list. [1]Azure Functions, Azure Container Apps and Azure Kubernetes Service (AKS). All marked HIPAA BAA; AKS on Azure Stack HCI is not. [1]An API that reads patient records runs here. Check the exact variant you deploy, because some editions are excluded from the list.
Secrets managementAWS Secrets Manager. On the eligible list. [1][2]Secret Manager. On the covered list. [1]Azure Key Vault stores secrets as well as keys. Marked HIPAA BAA in Appendix A. [1][2]Database passwords and API keys in environment files leak through logs and repos. A managed secret store with access logging closes that gap.
End-user sign-inAmazon Cognito. On the eligible list. [1]Identity Platform is on the covered list. Firebase Authentication is not named on the list. [1]Microsoft Entra ID and Azure Active Directory B2C. Both marked HIPAA BAA in Appendix A. [1]Patient and staff accounts, sessions and MFA events are often PHI-adjacent. Pick the identity service that sits on the covered list, not only the easiest SDK.
AI services
FactorAWSGoogle CloudAzureWhy it matters in healthcare
Managed LLM and AI servicesAmazon Bedrock and Bedrock AgentCore are on the eligible list, as are SageMaker AI (with listed exclusions), Comprehend Medical and Transcribe (including HealthScribe). [1]Vertex AI is now Gemini Enterprise Agent Platform. The platform and Generative AI on it are covered; Google says not to use Pre-GA offerings with PHI. [1][2]Azure OpenAI now sits under Foundry Models sold by Azure, marked HIPAA BAA. Third-party-operated model components are excluded from scope. [1][2]Summarizing notes or drafting care plans sends PHI to a model. Only the provider's covered AI service, in a GA release, belongs in that path.
Regions and cost
FactorAWSGoogle CloudAzureWhy it matters in healthcare
Regions and data residencyYou choose the Region for your content, and AWS says it will not move or replicate it outside that Region without your agreement. [1]The BAA covers all regions, zones and network paths. For Agent Search, Google asks you to use regional APIs and locations for PHI. [1]Most services let you pick the region, and Microsoft won't store or process data outside your Geo without authorization. Listed exceptions include Foundry Models. [1]Some health system contracts require data to stay in the US. Global AI deployments can process prompts outside the region you picked.
Internet egress pricing modelCharged per GB out to the internet. The first 100 GB a month is free, aggregated across services and Regions (except China and GovCloud). [1]Premium Tier (the default) is priced per GiB and varies by destination. Standard Tier varies by source region and includes 200 GiB a month free. Ingress is free. [1]Ingress is free and the first 100 GB a month out is free. After that, per-GB tiers on Microsoft's network or a cheaper ISP-routing option. [1]Imaging, bulk exports to payers and analytics extracts are egress-heavy. Model your largest outbound flow before comparing list prices.
Free tier and startup creditsNew accounts: up to $200 in Free Tier credits. AWS Activate: up to $5,000 if self-funded, up to $200,000 pre-Series B with an Activate Provider such as an accelerator or VC. [1][2]New accounts: $300 free credit. Google for Startups Cloud Program: up to $200,000, or up to $350,000 for AI-first startups. [1][2]Free account: $200 credit for 30 days plus 12 months of selected free services. Microsoft for Startups: up to $150,000 in credits. [1][2]Credits can cover a pilot's first year of hosting. They don't change what the BAA covers, so check eligibility before building on a free-only plan.
Your side of the line
FactorAWSGoogle CloudAzureWhy it matters in healthcare
Shared-responsibility caveatsPut PHI only in eligible services, and configure them to HIPAA requirements yourself. AWS secures the infrastructure the services run on. [1][2][3]Turn off or avoid non-covered products for PHI, skip Pre-GA offerings, and keep PHI out of resource metadata, labels and logs. [1]The BAA doesn't make your solution compliant. Microsoft doesn't inspect, approve or monitor your applications; compliance stays with you. [1]No HHS certification exists for HIPAA. Your app's access control, audit trail, backups and breach process are yours to build, whichever cloud you pick.

How we’d choose

AWS

Choose AWS when your team already runs on it

You already have AWS accounts, IAM patterns and Terraform modules, or you want Bedrock's model catalog and the broadest public eligible-service list under one BAA.

Google Cloud

Choose Google Cloud for a Postgres-first product

You want Cloud SQL, Cloud KMS, Cloud Audit Logs and Secret Manager in one console with little glue. MealCircle, our founder's product, runs on exactly that stack plus Firebase Authentication.

Azure

Choose Azure when the buyer is a Microsoft shop

The health system runs on Microsoft 365 and Entra ID and wants the app in its own Azure tenant, where the BAA already comes with its licensing agreement.

Azure

Choose Azure for OpenAI models inside a Microsoft tenant

You specifically need OpenAI models on PHI. Deploy them as Foundry Models sold by Azure, pick a regional deployment if residency matters, and stay off preview features.

Stay where the data already lives

If the practice's EHR extracts, imaging or data warehouse already sit in one cloud, moving large volumes out costs money every month. Build next to the data.

Pick the cloud your team can operate well

A HIPAA baseline done properly on a familiar cloud beats a new cloud done hastily. Our CCM/PCM client platform is PostgreSQL, FastAPI and Flutter web built to HIPAA requirements, and each of those pieces runs on covered managed services on all three.

What all three have in common

  • Each signs a HIPAA BAA and none charges a fee for it.
  • Each publishes which services may hold PHI; anything off that list stays PHI-free.
  • Each offers covered managed PostgreSQL, customer-managed keys, object storage, containers and serverless.
  • Each keeps some audit logs by default but needs you to extend retention or enable data-access logging.
  • Each has a managed generative AI service on its covered list, with exclusions you need to read.
  • Each says compliance is shared: the BAA covers their infrastructure, not your application.

How we’d set up a HIPAA-oriented baseline on each

The same five controls on every cloud, done before the first real user signs in. They are a starting point, not a complete compliance program.

Amazon Web Services

  1. Accept the BAA in AWS Artifact, at the organization level so new accounts inherit it.
  2. Create customer managed KMS keys and use them for RDS, S3 and backups.
  3. Turn on a CloudTrail trail to an encrypted, access-restricted S3 bucket before the first user signs in.
  4. Keep databases in private VPC subnets and reach AWS services through VPC endpoints.
  5. Store database credentials and API keys in Secrets Manager, never in environment files.

Google Cloud

  1. Accept the BAA on the IAM & Admin privacy page, and keep PHI projects to covered products.
  2. Create Cloud KMS keys and use CMEK for Cloud SQL, Cloud Storage and backups.
  3. Enable Data Access audit logs and export them to a locked bucket or BigQuery before the first user signs in.
  4. Give Cloud SQL a private IP only and put a VPC Service Controls perimeter around PHI projects.
  5. Store database credentials and API keys in Secret Manager, never in environment files.

Microsoft Azure

  1. Confirm your licensing agreement includes the Product Terms and DPA, and check every service against Appendix A.
  2. Use customer-managed keys in Key Vault for PostgreSQL, Blob Storage and backups.
  3. Add diagnostic settings that send activity and resource logs to Log Analytics with retention past 90 days before the first user signs in.
  4. Use Private Link endpoints and VNet integration, and turn off public network access on data services.
  5. Keep secrets in Key Vault and have apps read them with managed identities.

Related

Sources

Questions this page answers

Is AWS RDS HIPAA eligible?

Yes. Amazon RDS is on AWS's HIPAA Eligible Services Reference for the SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines, and Amazon Aurora is listed too. Eligibility only means you may store PHI there once your account has accepted the BAA in AWS Artifact. Encryption with KMS keys, private subnets, backups and access logging are still yours to configure. HIPAA-eligible services lookup

Does Google Cloud sign a BAA for Firebase?

Only indirectly. Google Cloud's BAA covers the products on its covered-products list, and no Firebase-branded product is on it. Some Firebase services, including Cloud Firestore, Cloud Storage for Firebase and Firebase Authentication, are governed by the Google Cloud terms, but being under those terms is not the same as being listed. Firestore and Cloud Storage are listed; for sign-in, Identity Platform is listed and Firebase Authentication is not. Map each Firebase feature to the list before any PHI touches it. HIPAA-eligible services lookup

Is Azure OpenAI covered by the BAA?

Azure OpenAI models are now offered as Foundry Models sold by Azure, and Microsoft's Azure Compliance Offerings document marks Microsoft Foundry: Foundry Models as in HIPAA BAA scope. The scope is limited to models sold by Azure; components operated by third-party model providers are excluded. Microsoft also notes that preview features may follow different privacy practices, and Global or DataZone deployments can process prompts outside your chosen region. The BAA itself comes through the Product Terms, so there is nothing separate to sign. Which vendors sign a HIPAA BAA

Which cloud is cheapest for a HIPAA SaaS?

It depends on your workload, not on HIPAA. None of the three charges for the BAA, and Google states HIPAA customers pay standard prices. The bill is driven by database size and high availability, how much data leaves the cloud each month, how long you keep audit logs, and which startup credits you qualify for. Price your own mix of services before choosing. Healthcare cloud cost estimator

Do I need a separate BAA for every account or project?

On AWS, a BAA accepted in one account covers that account; accepting it from the management account under Organization agreements covers every account in the organization. On Google Cloud, accepting in one project covers the whole account. On Azure, the BAA is part of the licensing agreement, so it applies to the services you buy under it.

Does signing the BAA make my app HIPAA compliant?

No. Google and Microsoft both state there is no HHS-recognized HIPAA certification, and all three describe compliance as shared. The provider covers its infrastructure and the listed services. Your team still owns access control, audit trails, encryption choices, backups, and the breach-response process for the application you build. HIPAA and SOC 2 cloud architecture