BAA guide
Is Amazon Web Services HIPAA compliant?
Plan by plan, from Amazon Web Services (AWS)'s own pages.
Only on a plan where the vendor signs a BAA. Amazon Web Services is not HIPAA compliant on its own. AWS account designated as a HIPAA account: AWS says you review and accept the BAA in AWS Artifact, and PHI belongs only in the HIPAA eligible services named in the BAA.
Checked against Amazon Web Services's own pages, linked in the table.
Which Amazon Web Services plans sign a BAA
| Plan | BAA | Condition | What the vendor page says |
|---|---|---|---|
| AWS account designated as a HIPAA account | BAA only if the condition is met | AWS says you review and accept the BAA in AWS Artifact, and PHI belongs only in the HIPAA eligible services named in the BAA. | Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.aws.amazon.com |
Rivvi
HIPAA BAA included
Rivvi's free organization plan (you and 2 colleagues) includes a HIPAA BAA, e-signed in the app before any patient data moves. The free personal plan is public information only.
Questions
Does AWS sign a BAA?
Yes. AWS says it has a standard Business Associate Addendum that it presents to customers for signature.
How do we accept the AWS BAA?
AWS says to sign in to AWS Artifact in the AWS Management Console to review, accept, and manage the status of the BAA for your account.
Can we put PHI in any AWS service?
No. AWS says customers may use any service in an account designated as a HIPAA account, but should only process, store, and transmit PHI in the HIPAA eligible services defined in the BAA.
Do our customers need their own BAA with AWS if we run a SaaS product on AWS?
AWS says no. The SaaS partner signs a BAA with AWS, and each covered entity signs a BAA with the SaaS partner.
Related
- Is Microsoft Azure HIPAA compliant?
- Is Zoom HIPAA compliant?
- Is Google Drive HIPAA compliant?
- Is Gmail HIPAA compliant?
- Is Microsoft Teams HIPAA compliant?
- Is Microsoft 365 HIPAA compliant?
- BAA directory: every tool Rivvi checked
- What makes a chatbot HIPAA compliant
- HIPAA compliant AI: which tools sign a BAA
- Check another AI tool against its BAA terms
Source: Amazon Web Services (AWS)'s own pages, linked in the table. Checked . Last updated . How Rivvi sources data. Spot an error? hello@rivvi.ai.
Free to start. Most teams are using it the same day.
Get started for free