HIPAA in the Cloud
AWS, Azure & GCP Guide

No cloud provider is "HIPAA certified" — HIPAA is a compliance obligation, not a certification, and there is no official HIPAA certificate. What the major providers do is sign a Business Associate Agreement (BAA) and publish a list of HIPAA-eligible services. Compliance is a shared outcome: the provider covers the infrastructure, and you cover how you configure and use it.

Yes. Before you store, process, or transmit PHI on AWS, Azure, or GCP, you must execute the provider's BAA. Without it, the provider has not agreed to its HIPAA obligations and your use of the platform for PHI is not compliant. The BAA also defines which services are in scope.

The cloud provider secures the underlying infrastructure — physical data centers, networking, and the hypervisor. You are responsible for everything you control: encryption settings, identity and access management, audit logging, OS patching on IaaS, application security, and backups. Using a HIPAA-eligible service does not transfer those duties to the provider.

No. A HIPAA-eligible service simply means the provider will cover it under the BAA. You still have to configure it correctly — enable encryption at rest and in transit, restrict access to least privilege, turn on audit logging, isolate networks, and document it all in a Security Risk Assessment. Misconfiguration is the most common cause of cloud PHI exposure.

All three (AWS, Azure, GCP) support fully HIPAA-eligible architectures, so the right choice usually depends on your existing stack, the healthcare-specific services you need (such as AWS HealthLake, Azure Health Data Services, or the GCP Cloud Healthcare API), and your team's expertise. Tranquility Cybersecurity helps Indian teams pick and validate the right configuration for their US clients.