They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
Running PHI workloads in the cloud requires understanding the shared responsibility model, signing BAAs, and implementing cloud-specific security controls.
Each provider requires you to sign its Business Associate Agreement (BAA) and stay within its published HIPAA-eligible services before PHI touches the cloud.
3Major clouds compared
100+AWS HIPAA-eligible services
1,000+Audits delivered
45 CFR Part 164 · HHS OCR · Last reviewed June 2026
Direct Answer
You can run HIPAA-regulated PHI on AWS, Azure, or Google Cloud, but each provider first requires you to sign its Business Associate Agreement (BAA) and stay within its published list of HIPAA-eligible services. Cloud HIPAA works on a shared-responsibility model: the provider secures the infrastructure while you remain responsible for configuration, encryption, access control, and your application.
Key Takeaways
- AWS, Azure, and Google Cloud each sign a Business Associate Agreement (BAA) and publish a list of HIPAA-eligible services — you must sign the BAA and stay within those services before placing PHI in the cloud.
- Cloud HIPAA runs on a shared-responsibility model: the provider secures the physical infrastructure, while you remain responsible for configuration, encryption, access control, and your application — being on a HIPAA-eligible service does not make you compliant by itself.
- A BAA with the cloud provider is necessary but not sufficient. You still need your own Security Risk Assessment, policies, audit logging, and (if you serve US clients) a BAA with those clients too.
- Tranquility Cybersecurity (TCSA) helps Indian healthcare and SaaS teams architect and validate HIPAA-eligible AWS, Azure, and GCP environments. Engagements are an indicative ₹1.5–4 lakh by scope.
Pick Your Platform
Major Cloud Providers
Amazon Web Services (AWS)
BAA AvailabilityAvailable via AWS Artifact
Coverage100+ HIPAA eligible services
AWS HealthLakeKMS encryptionCloudTrail loggingVPC isolationMicrosoft Azure
BAA AvailabilityIncluded in Online Services Terms
CoverageMost Azure services covered
Azure Health Data ServicesCustomer-managed keysAzure MonitorPrivate endpointsGoogle Cloud Platform
BAA AvailabilityAvailable via Cloud Console
CoverageAll GCP services covered under BAA
Healthcare APICloud KMSCloud Audit LogsVPC Service ControlsBuild It Right
Cloud HIPAA Best Practices
- Sign BAA before storing PHI
- Use only HIPAA-eligible services
- Enable encryption at rest and in transit
- Implement least privilege access
- Enable comprehensive audit logging
- Configure network isolation (VPC/VNet)
- Use managed key services (KMS)
- Enable multi-factor authentication
- Regular security assessments
- Document cloud architecture
Side by Side
BAA & HIPAA-Eligible Services by Provider
All three major clouds support HIPAA workloads, but they differ in how you sign the BAA and how broadly eligibility is scoped. Always confirm a specific service against the provider's current eligibility list before placing PHI on it.
| Provider | How to sign the BAA | Eligible-service coverage | Healthcare-native service |
|---|---|---|---|
| AWS | Self-serve via AWS Artifact | 100+ HIPAA-eligible services | AWS HealthLake (FHIR) |
| Microsoft Azure | Included in the Online Services / Product Terms | Most Azure services covered | Azure Health Data Services |
| Google Cloud | Accept via Cloud Console | BAA covers all in-scope GCP services | Cloud Healthcare API |
HIPAA is enforced by the US Department of Health and Human Services. See the official HHS HIPAA portal. Provider-specific, deep-dive guides: AWS, Azure, and GCP.
Explore further
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Is AWS, Azure, or Google Cloud "HIPAA certified"?
No cloud provider is "HIPAA certified" — HIPAA is a compliance obligation, not a certification, and there is no official HIPAA certificate. What the major providers do is sign a Business Associate Agreement (BAA) and publish a list of HIPAA-eligible services. Compliance is a shared outcome: the provider covers the infrastructure, and you cover how you configure and use it.
Do I need a BAA with my cloud provider?
Yes. Before you store, process, or transmit PHI on AWS, Azure, or GCP, you must execute the provider's BAA. Without it, the provider has not agreed to its HIPAA obligations and your use of the platform for PHI is not compliant. The BAA also defines which services are in scope.
What is the shared responsibility model for HIPAA in the cloud?
The cloud provider secures the underlying infrastructure — physical data centers, networking, and the hypervisor. You are responsible for everything you control: encryption settings, identity and access management, audit logging, OS patching on IaaS, application security, and backups. Using a HIPAA-eligible service does not transfer those duties to the provider.
Does using a HIPAA-eligible service make my application compliant?
No. A HIPAA-eligible service simply means the provider will cover it under the BAA. You still have to configure it correctly — enable encryption at rest and in transit, restrict access to least privilege, turn on audit logging, isolate networks, and document it all in a Security Risk Assessment. Misconfiguration is the most common cause of cloud PHI exposure.
Which cloud is best for HIPAA workloads from India?
All three (AWS, Azure, GCP) support fully HIPAA-eligible architectures, so the right choice usually depends on your existing stack, the healthcare-specific services you need (such as AWS HealthLake, Azure Health Data Services, or the GCP Cloud Healthcare API), and your team's expertise. Tranquility Cybersecurity helps Indian teams pick and validate the right configuration for their US clients.
Keep Exploring
Related Reading
HIPAA
HIPAA Knowledge Hub
Privacy Rule, Security Rule, BAAs, cloud guides and penalties.
Read moreHIPAA
HIPAA Security Rule
Administrative, physical and technical safeguards for ePHI.
Read moreHIPAA
Business Associate Agreements
What a BAA must contain and when you need one.
Read moreHIPAA
HIPAA Implementation
Phased compliance build for covered entities and business associates.
Read moreHIPAA
HIPAA Compliance
US health-data rules for healthtech and business associates.
Read moreSOC 2
SOC 2 for Healthtech
Where SOC 2 meets HIPAA for healthcare SaaS selling into the US.
Read more