Recommended Free Tools
You can host an application that handles electronic protected health information (ePHI) on a virtual machine or in containers, but neither architecture is “HIPAA compliant” by itself. The key questions are whether the cloud provider must act as your business associate and sign an appropriate business associate agreement (BAA), how ePHI moves through the deployment, and who implements each required safeguard.
Can I host a HIPAA app on a VM or in containers?
Yes. HHS Office for Civil Rights (OCR) guidance says a regulated entity may use cloud services to store or process ePHI if it enters into an appropriate BAA with a cloud service provider (CSP) acting as a business associate and otherwise complies with HIPAA. Public, private, and hybrid cloud configurations can all be used; each creates different risks and responsibilities that belong in the entity’s risk analysis.
As an Amazon Associate I earn from qualifying purchases.
A VM, a managed Kubernetes service, or a container runtime is an architecture choice, not a compliance designation. The customer still needs to understand the specific services and configuration involved, assess risks to the ePHI it handles, and manage those risks. HHS cites the Security Rule’s risk-analysis and risk-management requirements at 45 CFR §§ 164.308(a)(1)(ii)(A) and 164.308(a)(1)(ii)(B).
Do I need a BAA for cloud hosting?
Generally, yes, when a CSP creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate in a way that makes the CSP a business associate. HHS says a CSP that maintains ePHI for storage or processing generally remains a business associate even if the data is encrypted and the CSP does not possess the decryption key. Encryption does not remove the BAA obligation.
#1 Best Overall
The conduit exception is narrower: it generally applies to services that only transmit information, with transient storage incidental to transmission. Persistent cloud storage or processing is not made a transmission-only service simply because the provider cannot read the encrypted data.
What the agreement should cover
The BAA should define permitted uses and disclosures of ePHI and require appropriate safeguards. HHS also recommends aligning service-level terms with the BAA and HIPAA Rules. Depending on the service, those terms may address:
Rank #2
- Security responsibilities and how the parties will address applicable Security Rule requirements.
- Availability, reliability, backup, and recovery expectations.
- Return of ePHI at termination and how data is handled afterward.
- Use, retention, and disclosure of ePHI.
HHS advises that parties document in writing—in the BAA or another agreement—how applicable Security Rule requirements will be addressed. An agreement should match the service actually used, not just a provider’s general cloud offering.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDoes a BAA make the customer’s deployment compliant?
No. A BAA establishes contractual duties between the parties; it does not transfer the customer’s HIPAA responsibilities to the provider. Covered entities and business associates must still perform their own risk analysis and risk management for the ePHI they handle. HHS also explains that encryption alone does not ensure the integrity or availability of ePHI and does not replace administrative or physical safeguards.
Rank #3
Service eligibility is a separate question from whether a particular application and deployment comply. AWS identifies certain services as HIPAA-eligible and BAA-covered, while Microsoft says its BAA applies to in-scope services and does not make customer solutions compliant automatically. The scope can depend on the specific service and features in use. HHS OCR states that it does not endorse, certify, or recommend specific technologies or products.
Who is responsible for HIPAA compliance in the cloud?
Responsibility is shared, but the boundary depends on the service. For a VM, identify who operates the physical environment and host platform, then determine who manages the guest operating system, patches, identity, networking, logs, backups, recovery, application, and data. The evidence does not establish a universal VM responsibility matrix across providers, so confirm the boundary for the exact service and contract.
For containers, do not treat a managed control plane as proof that the customer workload is secured. The provider examples below describe different divisions of work; they are not compliance rankings, and provider service scope and documentation can change. The summaries reflect the provider materials referenced in this article as of October 7, 2026.
| Platform documentation | Provider-side responsibilities described | Customer-side responsibilities described |
|---|---|---|
| AWS and Amazon EKS | AWS describes “security of the cloud” as its responsibility within a shared-responsibility model. Its documentation identifies selected services as HIPAA-eligible and BAA-covered. | Customers remain responsible for “security in the cloud,” including container images and applications. EKS guidance also calls for customer attention to node and container configuration, data-plane security, and network controls. |
| Microsoft Azure and AKS | Microsoft says it manages the AKS control plane and selected platform components. | Customers manage workloads, data, networking, identity, and several configuration tasks. The AKS matrix marks upgrades, node OS images and patching, managed add-ons, and storage as shared areas. Microsoft also says it does not inspect, approve, or monitor customer applications. |
| Google Cloud and GKE | Google describes responsibility for underlying infrastructure and control-plane security. | Customers maintain workload code, build files, container images, data, IAM policy, and the containers and pods they run. |
For AWS EKS specifically, Linux containers use cgroups and namespaces to limit access but share the host EC2 instance’s Linux kernel. That is a description of the isolation model, not a HIPAA determination. See AWS’s EKS security guidance.
Best Value
Is Kubernetes HIPAA compliant?
Kubernetes is not compliant or noncompliant in isolation. A managed control plane can shift some platform operations to a provider, but the customer still needs to secure the workloads, data, identities, and configuration assigned to it. Container isolation also should not be mistaken for a separate physical host: in the EKS example above, containers share the host kernel.
Map the boundary before deployment
For each service in the deployment, record who owns and operates the following controls. Mark genuinely shared tasks explicitly, including who performs each action and who verifies it.
- Physical infrastructure, hypervisor or managed platform, control plane, nodes, and guest or node operating systems.
- Patch schedules, upgrades, runtime configuration, cluster add-ons, and container image build and scanning processes.
- User authentication, privileged administration, IAM or RBAC, and access to management tools and control planes.
- Network segmentation, secrets, encryption configuration, logging, application controls, and the ePHI itself.
- Backup, restore testing, service availability, incident response, and recovery responsibilities.
HHS notes that a no-view service can still have distinct duties on both sides: for example, the customer may control user authentication while the provider must protect administrative tools used to manage infrastructure resources.
How should I compare cloud hosting options?
Compare the actual services and responsibilities, rather than choosing by the words “VM,” “container,” or “managed.” Use this checklist during technical review and contract negotiation:
- BAA scope: Confirm that the exact services and features that create, receive, maintain, or transmit ePHI are in scope, and that the agreement’s terms fit the intended use.
- Control boundary: Identify who manages the physical environment, VM hosts, control plane, nodes, operating systems, runtime, and customer workloads.
- Identity and access: Assign responsibility for user authentication, privileged access, IAM or RBAC, and management-plane access.
- Data and network controls: Decide who configures segmentation, secrets, encryption, image security, logging, and application-level protections.
- Availability and recovery: Check that backup, restore paths, reliability commitments, and recovery arrangements fit operational needs.
- Exit and continuing access: Specify how ePHI will be returned or destroyed at termination and how required access will be maintained.
Ask the provider to identify the current in-scope service list and responsibility documentation for the services under consideration. Do not infer coverage for every service in an account from an eligibility label, and do not treat a BAA or product designation as OCR approval.
Quick Recap
What should I do before putting ePHI on the platform?
- Trace the data. Map where ePHI is created, transmitted, processed, stored, backed up, logged, and deleted. Include application and operational flows, not just the primary database.
- Confirm business-associate status and contract terms. Determine whether the provider maintains or processes ePHI for you, obtain an appropriate BAA where required, and align service-level terms with it.
- Verify service scope. Match every relevant cloud service and feature to the provider’s current in-scope documentation and agreement.
- Perform and document risk analysis. Assess the actual architecture and threats to confidentiality, integrity, and availability, then choose and document risk-management measures.
- Assign each control. Write down the provider and customer duties for identity, patching, networking, workload security, logging, backups, recovery, and incident handling.
- Test operational safeguards. Validate access restrictions, restore procedures, monitoring, and recovery arrangements in the configuration you intend to run.
- Plan for termination and change. Establish ePHI return or destruction procedures and revisit the analysis when services, features, agreements, or deployment responsibilities change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
