Aren&#x27;t you still building your own compliant environment on the application side with a heroku like model?<p>I&#x27;m pretty sure AWS has a package for HIPAA compliance that will checkmark most of the required fields outside of the application, and general settings fields. Most of the problems will come from the Application architecture. You can have a prebuilt envorionment for everything but if you&#x27;re code is garbage then good luck.<p>Not sure how hosting in AWS is any different from hosting on Heroku, considering you&#x27;re ultimately still responsible for the Application side. Does Heroku manages your logs in someway that AWS cannot?<p>Even with an agreement with a merchant, aren&#x27;t you still responsible for your application code? Isn&#x27;t that still subject to HIPAA requirements?<p>Also AWS is HIPAA compliant and they will do a Business Associate Agreement, and has been HITRUST certified iirc.