HIPAA-Compliant Cloud: AWS, Azure, Google Cloud and Microsoft 365

Shared Responsibility Snapshot

Provider Notes (Confirm on Public Docs)

• AWS: HIPAA-eligible services list + BAA via AWS Artifact — confirm current eligible services on AWS public HIPAA pages.
• Azure / Microsoft 365: Microsoft BAA covers in-scope online services; confirm service list on Microsoft Trust/compliance documentation. Purview helps information protection and audit.
• Google Cloud: GCP BAA / HIPAA implementation guidance for covered products — confirm on Google Cloud public compliance pages.

Always verify the live BAA scope before placing ePHI in a new service SKU.

How CyberSilo Helps

• CSA tracks which cloud accounts/services are in the ePHI boundary and BAA status
• ThreatHawk ingests cloud audit logs for §164.312(b) examination

Frequently Asked Questions

Does a cloud BAA make us HIPAA compliant?

No. A BAA is necessary for BA relationships with the provider but does not replace your Security Rule, Privacy Rule, and configuration duties.

Can we put PHI in any cloud service?

Only in services covered by the provider’s BAA / eligible list, configured per guidance, with your own access and logging controls.

Who monitors cloud admin access?

You do — typically via cloud audit logs into a SIEM such as ThreatHawk.

Related HIPAA Resources

HIPAA hub · SIEM · CSA