HIPAA-Compliant Cloud: AWS, Azure, Google Cloud and Microsoft 365

“HIPAA-compliant cloud” is not a magic checkbox. Major providers offer Business Associate Agreements for in-scope services and publish shared-responsibility guidance. You remain responsible for identity, configuration, logging, and minimum-necessary use of PHI.

Related: HIPAA hub · BAA · Encryption.

BAA — Covered entities must obtain satisfactory assurances via a Business Associate Agreement (see 45 CFR 164.308(b), 164.314(a), 164.504(e)). After HITECH / 2013 Omnibus, business associates are directly liable for Security Rule, certain Privacy Rule provisions, and Breach Notification Rule compliance.

Shared Responsibility Snapshot

Provider typically

Customer typically

BAA for eligible services; physical/datacenter controls

Which services store PHI; IAM; encryption config; logging; BA subprocessors you add

Provider Notes (Confirm on Public Docs)

AWS: HIPAA-eligible services list + BAA via AWS Artifact — confirm current eligible services on AWS public HIPAA pages.
Azure / Microsoft 365: Microsoft BAA covers in-scope online services; confirm service list on Microsoft Trust/compliance documentation. Purview helps information protection and audit.
Google Cloud: GCP BAA / HIPAA implementation guidance for covered products — confirm on Google Cloud public compliance pages.

Always verify the live BAA scope before placing ePHI in a new service SKU.

How CyberSilo Helps

CSA tracks which cloud accounts/services are in the ePHI boundary and BAA status
ThreatHawk ingests cloud audit logs for §164.312(b) examination

Make Cloud BAAs Operational

Inventory eligible services, encryption, and audit logging — not just the signed PDF.

Talk to CyberSilo HIPAA Automation

Frequently Asked Questions

Does a cloud BAA make us HIPAA compliant?

No. A BAA is necessary for BA relationships with the provider but does not replace your Security Rule, Privacy Rule, and configuration duties.

Can we put PHI in any cloud service?

Only in services covered by the provider’s BAA / eligible list, configured per guidance, with your own access and logging controls.

Who monitors cloud admin access?

You do — typically via cloud audit logs into a SIEM such as ThreatHawk.

HIPAA hub · SIEM · CSA

HIPAA-Compliant Cloud: AWS, Azure, Google Cloud and Microsoft 365

Shared Responsibility Snapshot

Provider Notes (Confirm on Public Docs)