AWS HIPAA-eligible services, read for healthcare.
AWS designates 174 services as eligible to process protected health information under a Business Associate Addendum. For 13 of them that designation is narrower than the service name — a model, an engine, a workforce, a channel — and that is usually where the real answer lives.
What a “yes” from AWS actually settles.
It settles three things
- AWS will carry PHI in that service once a BAA is in place.
- The service is a permitted substrate — you are not operating outside AWS’s terms by putting patient data there.
- AWS has designated it, and will say so in writing on its reference.
It settles nothing about
- Whether the specific feature, model or engine you are using falls inside the designation.
- Encryption, access control, logging, account boundaries and retention — all still yours.
- Whether the agreement covers the account the workload actually runs in.
- Whether your risk analysis concluded any of this was adequate.
AWS puts it plainly on the same page as the list: customers still must configure these services consistent with HIPAA requirements. Eligibility is necessary. It has never been sufficient.
The 20 services AWS qualifies.
AWS attaches bracketed text to 20 entries, and it does not all do the same work. 13 change what falls inside the designation — excluding a model, a workforce, a channel, or confining it to named engines. The other 7do something else: one applies a different agreement, two extend the designation rather than limit it, and the rest are former product names or part of a product’s own title. A service inventory recording only the service name captures none of it. AWS’s wording is quoted exactly; the reading beside it is ours.
Amazon Bedrock
AWS: [excluding Fable and Mythos models]
- Eligibility stops being a service-level question here. Bedrock is designated; two of the models you can invoke through it are not. A practice that decides “Bedrock is approved” and leaves model selection to whoever is building the feature has not actually answered the question — the answer changes per call.
Amazon SageMaker AI
AWS: [formerly Amazon Sagemaker, excludes Studio Lab, Ground Truth Plus, Public Workforce and Vendor Workforce for all features]
- The exclusions to watch are Public Workforce and Vendor Workforce. Those are the human labeling pools. Sending PHI into a training or annotation job that routes to them puts identifiable patient data in front of people outside your BAA chain, which is a disclosure question long before it is an architecture question.
Amazon Augmented AI
AWS: [excludes Public Workforce and Vendor Workforce for all features]
- Same exclusion, and it matters more than it looks: A2I exists to insert human review into a model's output. The whole point of the service is the reviewer, and two of the three reviewer pools sit outside the designation.
Amazon Pinpoint and End User Messaging (formerly Amazon Pinpoint)
AWS: [excluding Voice Message capabilities and WhatsApp Channel]
- Voice Message and the WhatsApp channel are excluded; the rest of the service is not. If patient messaging runs through either of those two channels the designation does not reach it — and a voice reminder carrying a name and a procedure is PHI in exactly the way a text one is.
AWS Fargate
AWS: [ECS and EKS engines only]
- Scoped to the ECS and EKS engines. The designation follows the orchestrator rather than the compute abstraction, so an architecture review that records “Fargate” as a single approved thing has recorded less than it needs to.
Amazon Relational Database Service (Amazon RDS)
AWS: [SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines only]
- AWS scopes RDS to six named engines and gives Aurora its own separate entry. Both are designated, but they are two designations rather than one with a variant, so an inventory recording only “RDS” has not captured which of them is running.
AWS Directory Service
AWS: [excludes Simple AD]
- Simple AD is excluded while the rest of Directory Service is not. It is the lightest-weight option AWS offers here, so this is a qualifier worth checking against what was actually deployed rather than against what was intended.
Amazon Connect Health
AWS: [a HCLS Service- Healthcare and Life Sciences Addendum applies]
- Nothing is excluded here — this qualifier changes the paperwork rather than the scope. AWS applies a Healthcare and Life Sciences Addendum to the service, so accepting the standard BAA does not finish the contractual work.
Alexa for Business
AWS: [for healthcare skills only – requires Alexa Skills BAA. See HIPAA whitepaper for details]
- Designated for healthcare skills only, and requiring a separate Alexa Skills BAA. Two conditions on one line — the use case is narrowed and the contractual path is different.
Amazon CloudFront
AWS: [excludes content delivery through Amazon CloudFront Embedded Point of Presences]
- Delivery through Embedded Points of Presence is excluded. Embedded PoPs sit inside ISP networks, so this is a distribution-configuration question rather than a service question, and it will not be visible to anyone reading a service inventory.
Amazon WorkDocs
AWS: [Excluding Adding Controls for Deleting Previous File Version Feature]
- One narrow feature exclusion around deleting previous file versions. Small, but version history on documents containing PHI is a records question, and the exclusion sits precisely there.
AWS Managed Services
AWS: [excluding Operations on Demand Services, except for the RFC Expedite feature]
- Operations on Demand is excluded except for RFC Expedite. If a managed-services engagement is doing work on your behalf, the designation covers the baseline service and not that add-on.
Amazon Quick
AWS: [formerly Amazon QuickSight, web only]
- Formerly QuickSight, and designated for the web experience only. Analytics over PHI is a common early build; the surface you view it through is part of the answer.
AWS Transcribe
AWS: [Includes Healthscribe]
- The only qualifier on the list that adds rather than removes. AWS states the designation includes HealthScribe, its clinical-documentation service — so a capability that would otherwise need its own answer is explicitly inside this one. Worth knowing precisely because the reflex with bracketed text is to read it as a restriction.
Kiro
AWS: [excluding Kiro Web]
- Kiro Web is excluded while Kiro itself is designated. A narrow split, and a useful reminder that the boundary can fall inside a product rather than around it.
The remaining qualifiers do not change scope. AWS Shield is designated at both tiers. Amazon DocumentDB and Amazon Keyspaces carry qualifications that are part of the products’ own names. Amazon EventBridge and Amazon WorkSpaces Applications name what each service was called before.
Frequently asked about, and not designated.
These come up often enough to be worth answering directly. Absence from AWS’s reference is not a statement that a service is unsafe — it means AWS has not designated it for PHI, which is the answer you need before routing patient data through it.
- AWS App Runner
- Not on AWS's reference. Its underlying primitives are designated, which is probably why people assume App Runner is too — but the designation is per service, and this one is absent.
- Amazon Lightsail
- Not on AWS's reference. Lightsail is frequently recommended for small deployments on cost grounds; that recommendation does not survive a PHI workload.
- AWS Snowcone and Snowmobile
- Not on AWS's reference, though Snowball and Snowball Edge are. The Snow family is not designated as a family.
Four kinds of obligation, routinely confused.
Most AWS-and-HIPAA writing — including an earlier version of this page — states all of these in the same voice, as though every line were law. They are not, and a practice that cannot tell them apart cannot tell which decisions are actually theirs to make.
HIPAA requires the outcome
The Security Rule is technology-neutral and mostly specifies results, not mechanisms. It requires a risk analysis, access controls, audit controls, integrity controls and transmission security — it does not name TLS versions, key-management products or availability architectures. Encryption at rest and in transit are addressable specifications under §164.312, which means you implement them or document why an equivalent measure is reasonable. Addressable is not optional, but it is not the same as prescribed.
AWS defines the condition
Which services may carry PHI, what the qualifiers exclude, and the fact that PHI must not go into a service before the agreement is in place — those are AWS's terms, and AWS can change them. So is the BAA itself: its scope, how you accept it, and whether it covers one account or an organization. When this page states a condition of this kind, the authority is AWS's published material and it is linked.
AWS's product behaves this way
Some constraints are neither law nor contract, just how the service works. RDS encryption has to be enabled at instance creation and cannot be switched on later without a snapshot-and-restore migration. S3 has applied default encryption since 2023. These shape what is practical, and they are the reason a compliance decision has to be made before a resource exists rather than after.
Patient Protect recommends the standard
IMDSv2 over v1, customer-managed KMS keys rather than service-managed ones for high-value PHI, access logs written to a separate account, security groups that never carry an open ingress rule on a PHI workload. We think these are the right operating standard for a practice that cannot absorb an incident. None of them is compelled by HIPAA, and we would rather say so than borrow the Security Rule's authority for our own engineering opinion.
The agreement: one account, or the whole organization.
Account agreement
Accepted in AWS Artifact by someone with authority to bind the practice. It covers that account and no other. Create a new account and it is uncovered until it accepts its own.
Organization agreement
Accepted by the management account of an AWS Organization. AWS states that all existing and subsequent member accounts are automatically covered and can legally process PHI.
The choice changes where the risk sits. Under an account agreement the risk is a missed acceptance. Under an organization agreement the risk inverts: accounts join and are covered automatically, so nobody is forced to decide whether that account should be holding PHI at all. Neither arrangement removes the need to know which accounts actually do.
A vendor’s AWS account is a different question entirely. It sits under that company’s own agreement with AWS and you cannot extend yours to reach it. What you need there is a business associate agreement between your practice and that company — a separate instrument from anything in AWS Artifact.
The full reference
All 174 designations as we recorded them on 27 August 2026, from a reference AWS last updated on 3 August 2026. AWS’s bracketed qualifications are reproduced exactly.
- Alexa for Business[for healthcare skills only – requires Alexa Skills BAA. See HIPAA whitepaper for details]
- AWS Amplify Console
- Amazon API Gateway
- AWS App Mesh
- AWS AppFabric
- Amazon AppFlow
- AWS Application Migration Service
- Amazon Application Recovery Controller
- AWS AppSync
- Amazon Athena
- AWS Audit Manager
- Amazon Augmented AI[excludes Public Workforce and Vendor Workforce for all features]
- Amazon Aurora
- AWS B2B Data Interchange
- AWS Backup
- AWS Batch
- Amazon Bedrock[excluding Fable and Mythos models]
- Amazon Bedrock AgentCore
- AWS Certificate Manager
- Amazon Chime
- Amazon Chime SDK
- AWS Clean Rooms
- AWS Cloud 9
- Amazon Cloud Directory
- AWS Cloud Map
- AWS CloudEndure
- AWS CloudFormation
- Amazon CloudFront[excludes content delivery through Amazon CloudFront Embedded Point of Presences]
- AWS CloudHSM
- AWS CloudShell
- AWS CloudTrail
- Amazon CloudWatch
- Amazon CloudWatch Logs
- Amazon CloudWatch SDK Metrics
- AWS CodeBuild
- AWS CodeCommit
- AWS CodeDeploy
- AWS CodePipeline
- Amazon Cognito
- Amazon Comprehend
- Amazon Comprehend Medical
- AWS Config
- Amazon Connect
- Amazon Connect Health[a HCLS Service- Healthcare and Life Sciences Addendum applies]
- AWS Control Tower
- AWS Data Exchange
- AWS Database Migration Service (DMS)
- AWS DataSync
- Amazon DataZone
- Amazon Detective
- AWS DevOps Agent
- Amazon DevOps Guru
- AWS Direct Connect
- AWS Directory Service[excludes Simple AD]
- Amazon DocumentDB[with MongoDB compatibility]
- Amazon DynamoDB
- Amazon EC2 Auto Scaling
- Amazon ElastiCache
- AWS Elastic Beanstalk
- Amazon Elastic Block Store (Amazon EBS)
- Amazon Elastic Compute Cloud (Amazon EC2)
- Amazon Elastic Container Registry (ECR)
- Amazon Elastic Container Service (ECS)
- AWS Elastic Disaster Recovery
- Amazon Elastic File System (EFS)
- Amazon Elastic Kubernetes Service (EKS)
- Elastic Load Balancing
- Amazon Elastic MapReduce (EMR)
- AWS Elemental MediaConnect
- AWS Elemental MediaConvert
- AWS Elemental MediaLive
- AWS Entity Resolution
- Amazon EventBridge[formerly Amazon Cloudwatch Events]
- AWS Fargate[ECS and EKS engines only]
- AWS Fault Injection Simulator
- AWS Firewall Manager
- Amazon Forecast
- Amazon FreeRTOS
- Amazon FSx
- AWS Global Accelerator
- AWS Glue
- AWS Glue DataBrew
- Amazon GuardDuty
- AWS HealthLake
- AWS HealthOmics
- AWS HealthImaging
- AWS IAM Identity Center
- Amazon Inspector
- AWS IoT Core
- AWS IoT Device Management
- AWS IoT Events
- AWS IoT Greengrass
- AWS IoT SiteWise
- Amazon Kendra
- AWS Key Management Service (KMS)
- Amazon Managed Service for Apache Flink
- Amazon Keyspaces[For Apache Cassandra]
- Amazon Kinesis Data Streams
- Amazon Kinesis Data Firehose
- Amazon Kinesis Video Streams
- AWS Lake Formation
- AWS Lambda
- Amazon Lex
- Amazon Location Service
- Amazon Macie
- AWS Mainframe Modernization
- AWS Managed Services[excluding Operations on Demand Services, except for the RFC Expedite feature]
- Amazon Managed Service for Prometheus
- Amazon Managed Workflow for Apache Airflow
- Amazon Managed Streaming for Apache Kafka
- AWS MCP Server
- Amazon MemoryDB
- Amazon MQ
- Amazon Neptune
- AWS Network Firewall
- Amazon Nova Act
- Amazon OpenSearch Service
- AWS OpsWorks for Chef Automate
- AWS OpsWorks for Puppet Enterprise
- AWS OpsWorks Stacks
- AWS Organizations
- AWS Outposts
- AWS Parallel Computing Service (PCS)
- Amazon Personalize
- Amazon Pinpoint and End User Messaging (formerly Amazon Pinpoint)[excluding Voice Message capabilities and WhatsApp Channel]
- Amazon Polly
- AWS Private Certificate Authority
- Amazon Q Business
- Amazon Quantum Ledger Database (QLDB)
- Amazon Quick[formerly Amazon QuickSight, web only]
- Amazon Rekognition
- Amazon Redshift
- Amazon Relational Database Service (Amazon RDS)[SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines only]
- AWS Resilience Hub
- AWS Resource Access Manager (RAM)
- AWS Resource Explorer
- Amazon Route 53
- Amazon S3 Glacier
- Amazon SageMaker AI[formerly Amazon Sagemaker, excludes Studio Lab, Ground Truth Plus, Public Workforce and Vendor Workforce for all features]
- AWS Secrets Manager
- AWS Security Hub CSPM (formerly AWS Security Hub)
- AWS Service Catalog
- AWS Serverless Application Repository
- AWS Shield[Standard and Advanced]
- Amazon Simple Email Service (Amazon SES)
- Amazon Simple Notification Service (SNS)
- Amazon Simple Queue Service (SQS)
- Amazon Simple Storage Service (S3)
- Amazon Simple Workflow Service (SWF)
- AWS Snowball
- AWS Snowball Edge
- AWS Step Functions
- AWS Storage Gateway
- AWS Systems Manager
- Amazon Textract
- Amazon Timestream
- AWS Transcribe[Includes Healthscribe]
- AWS Transfer Family
- AWS Transform
- Amazon Translate
- AWS Verified Access
- Amazon Verified Permissions
- Amazon Virtual Private Cloud (VPC)
- AWS Web Application Firewall (WAF)
- AWS Wickr
- Amazon WorkDocs[Excluding Adding Controls for Deleting Previous File Version Feature]
- Amazon WorkLink
- Amazon WorkSpaces
- Amazon WorkSpaces Applications[formerly known as Amazon AppStream 2.0]
- Amazon WorkSpaces Thin Client
- Amazon WorkSpaces Secure Browser
- AWS X-Ray
- Kiro[excluding Kiro Web]
- VM Import/Export
The part AWS hands back to you.
Patient Protect does not connect to your AWS account, and nothing here reads your cloud configuration. That work stays with whoever administers the environment.
What the platform holds is the layer above it — the systems and vendors your practice has declared, the agreements covering them, who has access, and where PHI actually moves between them. An AWS account appears there as one node among the vendors, devices and workflows around it, which is the view a risk analysis under §164.308(a)(1)(ii)(A) has to account for regardless of who runs the infrastructure.
If you are working out what your AWS footprint obliges, the honest next step is the map, not a trial.
AWS HIPAA eligibility, answered.
- How many AWS services are HIPAA eligible?
- AWS designates 174 services on its HIPAA Eligible Services Reference as of 3 August 2026, the date AWS states it last updated that page. Patient Protect counted them from the published reference on 27 August 2026. AWS does not publish a running total itself, and the number moves as services are added and removed, so treat it as a reading with a date attached rather than a fixed figure.
- Does HIPAA eligibility mean a service is HIPAA compliant?
- No, and AWS says so directly: customers must still configure eligible services consistently with HIPAA requirements. Eligibility means AWS will carry PHI in that service under a Business Associate Addendum. Encryption, access control, account boundaries, logging and retention remain yours, and so does the risk analysis that decides what is adequate.
- Do I need a separate AWS BAA for every account?
- Not necessarily. AWS Artifact offers account agreements and organization agreements. An account agreement covers the single account that accepts it. An organization agreement, accepted by the management account of an AWS Organization, covers every member account — AWS states that all existing and subsequent member accounts are automatically covered. Which one you hold changes what happens when someone creates the next account.
- Is a vendor's AWS account covered by our BAA?
- No. A vendor or contractor account sits under that company's own agreement with AWS, and you cannot extend yours to cover it. What you need in that relationship is a business associate agreement between your practice and that company — a separate instrument from anything in AWS Artifact.
- Can I use Amazon Bedrock with PHI?
- AWS lists Amazon Bedrock as eligible and excludes the Fable and Mythos models from that designation. This is the pattern worth internalising: for Bedrock the eligibility question is not settled at the service level, because which model you invoke sits inside the designation or outside it. Check the model, not only the service.
- Does HIPAA require six-year retention of backups?
- No. The six-year rule at §164.316(b)(2) applies to documentation the Security Rule requires you to maintain — policies, procedures, and records of required activities and assessments. It is not a retention period for ePHI or for backups of it. Backup and snapshot retention is driven by continuity requirements and by state medical-record law.
- Is dedicated tenancy required for HIPAA on EC2?
- No. AWS removed the dedicated-tenancy requirement for HIPAA workloads in 2017, and shared-tenancy instances are fully eligible. The belief that dedicated tenancy is still required adds meaningful cost to a migration for no compliance benefit.
From an AWS answer to a compliance program
The cloud is one vendor. Compliance is all of them.
AWS covers what AWS does. Patient Protect runs the layer your practice is responsible for — vendor and BAA inventory, workforce training, access and audit review, incident response, and the risk analysis that ties them together.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.