Signing AWS's Business Associate Addendum takes a few clicks in AWS Artifact. It covers only HIPAA-eligible services, and it leaves most of the Security Rule with you. What the October 2026 eligible list includes (Bedrock, AgentCore, HealthLake, HealthScribe), the split of responsibilities, and why we build to the proposed Security Rule even though it is not final.
AWS offers a Business Associate Addendum to any account through AWS Artifact. Its condition is short: if you are a covered entity or business associate, you may not use a service for protected health information (PHI) unless it is on AWS's HIPAA Eligible Services list and you have accepted the BAA. AWS also states the part people skip: customers are responsible for their own HIPAA compliance.
The list was last updated on October 15, 2026 and covers most services an application needs, including Amazon Bedrock, Bedrock AgentCore, HealthLake, HealthScribe, Transcribe, Textract and Comprehend Medical. Check it for every service in your architecture, including the ones that only see PHI indirectly: logs, queues, search indexes and analytics.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
HHS proposed the first major Security Rule update in a decade on January 6, 2025. It would remove the distinction between "required" and "addressable" safeguards and make specific controls mandatory, including encryption at rest and in transit, multi-factor authentication, an asset inventory and network map, regular vulnerability scanning and penetration testing, and the ability to restore critical systems within 72 hours. As of October 2026 it is still a proposal and the current rule is the one enforced.
On AWS most of the proposed controls are configuration rather than projects: KMS encryption by default, Identity Center with MFA, Config and Systems Manager inventory, Inspector scanning, AWS Backup with a tested restore. That is why we build new environments to the proposal now. Retrofitting the same controls later costs more than turning them on at the start.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
Tracking Pixels and Analytics on Healthcare Websites in 2026: What Changed and What Did Not
A 2024 court decision vacated part of HHS's guidance on online tracking, the part about public, unauthenticated pages. Tracking on patient portals and in apps that handle PHI is still covered, most ad and analytics vendors will not sign a BAA, and the FTC brings its own cases. What is still risky and the setup we would use instead.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.