Speaking from a HIPAA point of view, the amount of complexity you must manage to build your own compliant environment on AWS is extremely high. HIPAA&#x27;s controls account for block level encryption, managing your logs a certain way, and many many more things.<p>Furthermore, compliance is more than just doing the right thing. It&#x27;s proving that you are compliant. There is immeasurable value with selecting a vendor who is audited to be HIPAA Compliant or HITRUST Certified because then the risk is offloaded to someone with credibility in the marketplace via a Business Associate Agreement. If you wanted to build your own HIPAA compliant stack on AWS, and you want to be taken as credible when trying to sell to a CIO at a hospital, then you will need to go through the procedure of becoming HITRUST Certified as well.<p>Otherwise you will just be nibbling at the edges and taking on all the risk while hampering your business model.