What Are AWS HIPAA Eligible Services?
Security and compliance in Amazon Web Services (AWS) follows a Shared Responsibility Model. This means that security responsibilities are split between the Cloud Platform and the Client. For healthcare organizations and companies dealing with HIPAA regulations, the AWS Business Associate Addendum (BAA) dictates how customers must utilize AWS to maintain HIPAA compliant workloads.
In order to fulfill your responsibilities under the BAA, and maintain HIPAA compliance in the cloud, Amazon provides a list of AWS services that are considered “HIPAA eligible”. Organizations must configure administrative and technical safeguards alongside exclusively using these services, to use Amazon services with protected health information (PHI).
HIPAA Eligible Services From Amazon Web Services
AWS provides a list of HIPAA eligible services, which currently includes the following services:
- Alexa for Business [for healthcare skills only – requires Alexa Skills BAA. See HIPAA whitepaper for details]
- AWS Amplify Console
- Amazon API Gateway
- AWS App Mesh
- AWS AppFabric
- Amazon AppFlow
- AWS Application Migration Service
- Amazon Application Recovery Controller
- AWS AppSync
- Amazon Athena
- AWS Audit Manager
- Amazon Augmented AI [excludes Public Workforce and Vendor Workforce for all features]
- Amazon Aurora
- AWS B2B Data Interchange
- AWS Backup
- AWS Batch
- Amazon Bedrock [excluding Fable and Mythos models]
- Amazon Bedrock AgentCore
- AWS Certificate Manager
- Amazon Chime
- Amazon Chime SDK
- AWS Clean Rooms
- AWS Cloud 9
- Amazon Cloud Directory
- AWS Cloud Map
- AWS CloudEndure
- AWS CloudFormation
- Amazon CloudFront [excludes content delivery through Amazon CloudFront Embedded Point of Presences]
- AWS CloudHSM
- AWS CloudShell
- AWS CloudTrail
- Amazon CloudWatch
- Amazon CloudWatch Logs
- Amazon CloudWatch SDK Metrics
- AWS CodeBuild
- AWS CodeCommit
- AWS CodeDeploy
- AWS CodePipeline
- Amazon Cognito
- Amazon Comprehend
- Amazon Comprehend Medical
- AWS Config
- Amazon Connect
- Amazon Connect Health [a HCLS Service- Healthcare and Life Sciences Addendum applies]
- AWS Control Tower
- AWS Data Exchange
- AWS Database Migration Service (DMS)
- AWS DataSync
- Amazon DataZone
- Amazon Detective
- AWS DevOps Agent
- Amazon DevOps Guru
- AWS Direct Connect
- AWS Directory Service [excludes Simple AD]
- Amazon DocumentDB [with MongoDB compatibility]
- Amazon DynamoDB
- Amazon EC2 Auto Scaling
- Amazon ElastiCache
- AWS Elastic Beanstalk
- Amazon Elastic Block Store (Amazon EBS)
- Amazon Elastic Compute Cloud (Amazon EC2)
- Amazon Elastic Container Registry (ECR)
- Amazon Elastic Container Service (ECS)
- AWS Elastic Disaster Recovery
- Amazon Elastic File System (EFS)
- Amazon Elastic Kubernetes Service (EKS)
- Elastic Load Balancing
- Amazon Elastic MapReduce (EMR)
- AWS Elemental MediaConnect
- AWS Elemental MediaConvert
- AWS Elemental MediaLive
- AWS Entity Resolution
- Amazon EventBridge [formerly Amazon Cloudwatch Events]
- AWS Fargate [ECS and EKS engines only]
- AWS Fault Injection Simulator
- AWS Firewall Manager
- Amazon Forecast
- Amazon FreeRTOS
- Amazon FSx
- AWS Global Accelerator
- AWS Glue
- AWS Glue DataBrew
- Amazon GuardDuty
- AWS HealthLake
- AWS HealthOmics
- AWS HealthImaging
- AWS IAM Identity Center
- Amazon Inspector
- AWS IoT Core
- AWS IoT Device Management
- AWS IoT Events
- AWS IoT Greengrass
- AWS IoT SiteWise
- Amazon Kendra
- AWS Key Management Service (KMS)
- Amazon Managed Service for Apache Flink
- Amazon Keyspaces [For Apache Cassandra]
- Amazon Kinesis Data Streams
- Amazon Kinesis Data Firehose
- Amazon Kinesis Video Streams
- AWS Lake Formation
- AWS Lambda
- Amazon Lex
- Amazon Location Service
- Amazon Macie
- AWS Mainframe Modernization
- AWS Managed Services [excluding Operations on Demand Services, except for the RFC Expedite feature]
- Amazon Managed Service for Prometheus
- Amazon Managed Workflow for Apache Airflow
- Amazon Managed Streaming for Apache Kafka
- AWS MCP Server
- Amazon MemoryDB
- Amazon MQ
- Amazon Neptune
- AWS Network Firewall
- Amazon Nova Act
- Amazon OpenSearch Service
- AWS OpsWorks for Chef Automate
- AWS OpsWorks for Puppet Enterprise
- AWS OpsWorks Stacks
- AWS Organizations
- AWS Outposts
- AWS Parallel Computing Service (PCS)
- Amazon Personalize
- Amazon Pinpoint and End User Messaging (formerly Amazon Pinpoint) [excluding Voice Message capabilities and WhatsApp Channel]
- Amazon Polly
- AWS Private Certificate Authority
- Amazon Q Business
- Amazon Quantum Ledger Database (QLDB)
- Amazon Quick [formerly Amazon QuickSight, web only]
- Amazon Rekognition
- Amazon Redshift
- Amazon Relational Database Service (Amazon RDS) [SQL Server, MySQL, Oracle, PostgreSQL, Db2 and MariaDB engines only]
- AWS Resilience Hub
- AWS Resource Access Manager (RAM)
- AWS Resource Explorer
- Amazon Route 53
- Amazon S3 Glacier
- Amazon SageMaker AI [formerly Amazon Sagemaker, excludes Studio Lab, Ground Truth Plus, Public Workforce and Vendor Workforce for all features]
- AWS Secrets Manager
- AWS Security Hub CSPM (formerly AWS Security Hub)
- AWS Service Catalog
- AWS Serverless Application Repository
- AWS Shield [Standard and Advanced]
- Amazon Simple Email Service (Amazon SES)
- Amazon Simple Notification Service (SNS)
- Amazon Simple Queue Service (SQS)
- Amazon Simple Storage Service (S3)
- Amazon Simple Workflow Service (SWF)
- AWS Snowball
- AWS Snowball Edge
- AWS Step Functions
- AWS Storage Gateway
- AWS Systems Manager
- Amazon Textract
- Amazon Timestream
- AWS Transcribe [Includes Healthscribe]
- AWS Transfer Family
- AWS Transform
- Amazon Translate
- AWS Verified Access
- Amazon Verified Permissions
- Amazon Virtual Private Cloud (VPC)
- AWS Web Application Firewall (WAF)
- AWS Wickr
- Amazon WorkDocs [Excluding Adding Controls for Deleting Previous File Version Feature]
- Amazon WorkLink
- Amazon WorkSpaces
- Amazon WorkSpaces Applications [formerly known as Amazon AppStream 2.0]
- Amazon WorkSpaces Thin Client
- Amazon WorkSpaces Secure Browser
- AWS X-Ray
- Kiro [excluding Kiro Web]
- VM Import/Export
NOTE: If you are a Covered Entity or Business Associate as defined by the Health Insurance Portability and Accountability Act of 1996 (as amended, “HIPAA”), you agree not to use these HIPAA Eligible Services for any purpose or in any manner involving Protected Health Information (as defined by HIPAA) without first entering into an AWS business associate agreement.
Can I Use AWS Services That Are Not HIPAA Eligible?
AWS services that are not listed under the HIPAA eligible services list may not be used to store, process, or transmit any protected health information (PHI).
With that said, there are many AWS services that can be effectively utilized without PHI. Here are some examples of where non-HIPAA eligible services may be used in healthcare settings:
- Your organization may host your marketing website that does not use PHI on non-HIPAA eligible services.
- Your organization may use non-HIPAA eligible services for continuous integration/deployment processes that do not involve PHI.
- Your organization may host/deploy non PHI services such as self-hosted CRM products, Productivity tools, etc in non-compliant services.
Architecting HIPAA Compliant Applications
It is possible to use HIPAA compliant services and still not be HIPAA compliant. Under Amazon’s Shared Responsibility Model, organization’s must manage administrative and technical safeguards in order to maintain HIPAA compliance in AWS. This means that besides utilizing AWS HIPAA eligible services, clients must define HIPAA administrative policies and implement appropriate technical controls. Dash continuous compliance monitoring allows teams to setup policy and technical controls, remediate compliance issues and continually monitor and access their Security Plan in Amazon Web Services.
Ready to learn more about HIPAA compliance and the cloud? Download our guide to “Managing HIPAA in AWS”.
