No, kgosser is correct. AWS offers &quot;HIPAA-eligible services&quot;. Batteries not included.<p>Being able to demonstrate HIPAA compliance is different. You need to be able to:<p>1) Prove that a wide range of controls are in place and operating effectively, many of which are administrative (risk assessments, policy controls, workforce training, manual config reviews, access control reviews, etc.)<p>2) Keep all of your documentation current, even as your code and architecture changes.<p>If you DIY on AWS, you accept all of the risk for everything from the hypervisor up. Not just the risk of adversarial breach, but misconfiguration, inappropriate configuration, patching, etc.