Skip to main content
BAA Directory

Is Amazon Web Services (AWS) HIPAA compliant? Does it sign a BAA?

The answer

Signs a BAA

Yes. AWS presents a standard Business Associate Addendum to customers, covering the HIPAA-eligible services it lists.

Automation and workspace. Checked on the vendor's own pages on .

Using Amazon Web Services (AWS) on a healthcare site? Curve Compliance keeps your ad tracking HIPAA-compliant around it, under a BAA on every plan. Book a call

On this page

What Amazon Web Services says

“Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.”

Source: AWS HIPAA Compliance, FAQs, checked .

“To review, accept, and manage the status of the BAA for your account, sign in to AWS Artifact in the AWS Management Console.”

Source: AWS HIPAA Compliance, FAQs, checked .

What the BAA covers and excludes

Excludes or limits, in Amazon Web Services's words:

  • "Customers may use any AWS service in an account designated as a HIPAA account, but they should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services defined in the Business Associate Addendum (BAA)."

What this means for ad tracking

AWS often hosts the website, landing pages, databases and lead pipelines behind a healthcare funnel, so lead and patient records can sit there.

A BAA with AWS covers the PHI you keep in its HIPAA-eligible services. It does not cover an ad platform: a pixel on a site hosted on AWS, or a conversion your own server sends to Meta or Google, still reaches a company outside that BAA. See the Meta and Google Ads entries.

Curve Compliance closes that gap: it sends the conversion itself server-side, under a BAA it signs on every plan, so your campaigns keep a conversion signal without a pixel carrying patient data. Book a call to see it on your own funnel.

How Curve helps

  • Keep Amazon Web Services (AWS) for what it does well. Curve carries the conversion signal to your ad platforms separately, under its own BAA.
  • Server-side conversion tracking in place of pixels: conversions reach your ad platforms from Curve's server, not from the patient's browser.
  • A fixed field list per platform, so each ad platform receives only the fields set for it.
  • PHI-like pattern detection checks every event before it goes out, and neutral event names keep conditions and treatments out of what the platforms see.
  • When identifiers are enabled, Curve hashes them with SHA-256.
  • Consent management for your site, alongside the tracking.
  • A HIPAA-compliant setup done by Curve's team, with a BAA signed on every plan.

Book a call with Curve and Curve's team will walk through your tracking setup with you.

Frequently asked questions

Is Amazon Web Services (AWS) HIPAA compliant?

Yes. AWS presents a standard Business Associate Addendum to customers, covering the HIPAA-eligible services it lists. With a signed BAA, Amazon Web Services (AWS) can handle patient information for you, set up the way the vendor describes. The BAA does not cover ad pixels or tags on the same pages, because they send data to other companies.

Does Amazon Web Services (AWS) sign a BAA?

Yes. AWS presents a standard Business Associate Addendum to customers, covering the HIPAA-eligible services it lists. In AWS's words: “Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature.” We checked AWS's own pages on October 5, 2026.

How do I get a BAA from AWS?

Sign in to AWS Artifact in the AWS Management Console to review and accept the BAA for your account. AWS says PHI should only go through the HIPAA-eligible services the BAA defines, and it lists them on its HIPAA Eligible Services Reference page.

Does a BAA with AWS cover my ad pixels?

No. A BAA covers the data AWS handles for you. A pixel sends data from the visitor's browser straight to Meta, Google or TikTok, and none of those platforms is a party to your BAA with AWS.

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan, and Curve's team does the HIPAA-compliant setup for you. Book a call to get started.

Sources

Last checked . Vendors change their plans and terms, so confirm the current terms with Amazon Web Services before you send it patient data.

See every tool in the BAA Directory.

Track ad conversions under a BAA

Curve signs a BAA on every plan. Curve's team sets up HIPAA-compliant conversion tracking for you in about a week, sending conversions server-side in place of pixels.

Book a call