Amazon Web Services Review for HIPAA or PCI Compliance Needs

The research in brief

Amazon Web Services is a mixed fit for a small practice or regulated retailer that wants affordable, entry-level hosting for HIPAA or PCI compliance. Two of seven platforms named AWS during the ranking stage, at an average listed rank of 8.5 and a best rank of 7. The strongest reason to consider it is that AWS offers a self-service Business Associate Addendum at no additional charge and lists Amazon EC2 as HIPAA-eligible, with PCI DSS Level 1 infrastructure attestations available through AWS Artifact. The main limitation is that AWS is not turnkey: the buyer must design, configure, operate, and document the compliant environment, and Amazon Lightsail is not confirmed as HIPAA-eligible.

Research Snapshot

Why Amazon Web Services Qualified for This Study

Questions explored

• Is Amazon Web Services a good choice for hosting for HIPAA or PCI compliance on a small-business budget?
• Why did only two AI platforms name Amazon Web Services for entry-level HIPAA or PCI hosting?

AWS qualified because it meets the study's compliance criteria on paper: a signed BAA is available, HIPAA-eligible services are published, PCI DSS attestations exist, and encryption tooling is documented. Two of seven platforms named AWS in the ranking stage, at ranks 10 and 7, giving an average listed rank of 8.5 (Claude, Kimi). That is a low placement relative to the field, and it reflects the platforms' shared concern rather than any doubt about AWS's compliance credentials.

The qualification is also structural. AWS is the reference point other providers are compared against, and five of the seven platforms that evaluated fit returned a mixed rating, while two returned a good rating. No platform rated AWS as a poor fit outright. The disagreement is about buyer profile, not capability.

The hosting offering in focus

Questions explored

• Which Amazon Web Services plan should a small practice choose for HIPAA-eligible hosting, EC2 or Lightsail?
• Is Amazon Lightsail HIPAA-eligible for a practice that needs to store patient data?

Amazon EC2 is the relevant product, paired with an executed AWS Business Associate Addendum and only HIPAA-eligible supporting services for protected health information. AWS states that it provides a standard Business Associate Addendum and that PHI may be processed, stored, or transmitted only through HIPAA-eligible services and only after the required BAA is executed ^[7]. Amazon EC2 appears on AWS's HIPAA-eligible services reference, updated September 3, 2026, subject to the shared-responsibility model ^[19].

Amazon Lightsail is the trap in this category. It is inexpensive and marketed as simple, but it was not found in AWS's current HIPAA-eligible services reference, so its HIPAA status for PHI hosting should not be assumed from the fact that it runs on AWS infrastructure ^[19]. Independent 2026 sources state directly that Lightsail is not HIPAA-eligible and cannot be used with PHI even with a BAA in place ^[49]. One platform reported that only select Lightsail instances are covered under HIPAA eligibility, which conflicts with the other findings and should be treated as unresolved ^[40].

For PCI, the relevant unit is an AWS architecture built from services listed in the current PCI DSS scope documentation, not a single plan. AWS states that it is a PCI DSS Level 1 Service Provider ^[10].

What the AI Platforms Agreed About

Questions explored

• Do all AI platforms agree that Amazon Web Services can sign a BAA for HIPAA hosting?
• Is Amazon EC2 consistently listed as HIPAA-eligible across AI platform research?

Agreement was strong on four points. First, the BAA exists and is self-service. AWS offers a standard BAA to commercial accounts at no additional charge, accepted through AWS Artifact without a sales contact ^[32]. Second, EC2 is HIPAA-eligible. Third, AWS holds PCI DSS Level 1 Service Provider status, with the Attestation of Compliance and responsibility documentation available through AWS Artifact ^[10]. Fourth, the shared-responsibility model places configuration, encryption, access control, logging, and evidence on the customer ^[12].

Platforms also agreed that AWS does not automatically make a buyer compliant. AWS states that customers do not automatically inherit HIPAA compliance and must configure and implement controls within eligible services ^[2]. Independent guidance describes default EC2 settings as not HIPAA compliant without configuration for encryption, access control, and logging ^[37].

Where the AI Platforms Disagreed or Were Uncertain

Questions explored

• Is Amazon Lightsail HIPAA-eligible, and which AI platforms disagree on this point?
• How much does HIPAA compliance add to an Amazon Web Services bill each month?

Three conflicts matter to a buyer. The first is Lightsail eligibility. Most platforms treat Lightsail as excluded from HIPAA eligibility ^[49], while one platform reported that select Lightsail instances are covered and that the smallest tiers require verification before deploying PHI ^[40]. This conflict is unresolved in the supplied evidence and should be settled in writing with AWS before any PHI touches Lightsail.

The second is the HIPAA-eligible service count. Independent sources cite 200+ services as of 2026, 166+ as of April 2026, and 174 in another listing ^[34]. The list is continuously updated, so the count varies by publication date.

The third is compliance cost overhead. Independent estimates range from 15–25% additional infrastructure cost to 20–40% more for HIPAA workloads, with smaller deployments seeing higher percentage impact ^[33]. One platform's pricing confidence was low and another's was moderate, and no platform produced a verified total monthly figure for a compliant small-practice configuration (Perplexity, ChatGPT, DeepSeek, Kimi platform-reported).

Features for this workload

Questions explored

• What encryption and audit-logging features does Amazon Web Services require for HIPAA-eligible hosting?
• Does Amazon Web Services provide compliance documentation a small practice can hand to an auditor?

AWS HIPAA guidance states that PHI must be encrypted at rest and in transit when using HIPAA-eligible services ^[3]. AWS KMS provides centralized key management with audit logging of key usage ^[20]. Services such as RDS, S3, and EBS support encryption, and API Gateway uses HTTPS by default, though encryption adds operational complexity ^[33]. AWS also documents encryption options including AES-256 and TLS across many services ^[6].

On documentation, AWS publishes a HIPAA-eligible services reference, maintains SOC 1/2/3 and ISO 27001 certifications, and provides compliance reports through AWS Artifact ^[8]. AWS also publishes PCI service-scope information and responsibility materials ^[11]. These materials describe AWS's covered infrastructure and responsibilities, not the buyer's completed compliance status.

The operational burden is the defining capability gap. Customers must implement administrative, technical, and physical safeguards including KMS encryption, IAM policies, CloudTrail logging, and security group configuration ^[51]. AWS prescriptive guidance identifies the need for engineers familiar with cloud security and compliance best practices for healthcare data strategies ^[23]. Using any non-HIPAA-eligible AWS service with PHI is a compliance violation even after BAA acceptance, and AWS does not prevent it ^[34]. The AWS BAA also covers only AWS; EHR vendors, email providers, and payment processors each require their own BAA ^[37].

Pricing, renewal terms, and ongoing costs

Questions explored

• How much does Amazon Web Services cost per month for a small HIPAA-compliant hosting setup?
• Are there setup fees, cancellation fees, or long-term contracts for Amazon Web Services compliance hosting?

AWS is consumption-priced rather than sold as a compliance-tier hosting package, and no platform produced a verified total monthly cost for a compliant small-practice deployment. AWS states that it uses pay-as-you-go pricing for the vast majority of services without long-term contracts or termination fees (official:C2). AWS also offers flat-rate plans that combine multiple services into one price, and Savings Plans that trade a one- or three-year commitment for discounts (official:C2, official:C3).

Known component costs reported by platforms include Lightsail plans billed hourly up to a monthly maximum, with the least expensive plan starting at $5 per month, and Lightsail snapshots charged at $0.05 per GB-month ^[22]. Lightsail instances and managed databases can continue accruing charges while stopped ^[22]. One platform reported EC2 on-demand at roughly $0.0116/hour for a T4g.micro, KMS at about $1 per customer-managed key per month, CloudTrail plus S3 logging at roughly $50–200 per month, CloudWatch monitoring at roughly $100–500 per month, and automated backups at roughly $100–1,000 per month depending on data size (Claude platform-reported). Another reported EC2 t3.medium at roughly $30–50 per month and a typical small compliant setup at roughly $200–400 per month (Grok platform-reported). These figures are platform-reported and were not independently verified.

Additional costs include AWS support plans, which one platform reported starting at about $100 per month for Business tier, third-party compliance assessors, PCI Qualified Security Assessors, consultants, managed-service providers, penetration testing, and audit preparation (ChatGPT, Claude, Kimi platform-reported). Reserved Instances, Savings Plans, support agreements, and Marketplace products may introduce commitment periods or separate cancellation terms (ChatGPT platform-reported). The BAA itself carries no additional charge ^[32].

Best Suited For

Questions explored

• Who gets the most value from Amazon Web Services for HIPAA or PCI compliance hosting?
• Is Amazon Web Services worth it for a small practice that already has cloud engineering skills?

AWS is best suited to small regulated organizations that have internal cloud engineering capability or a qualified AWS managed-service provider. It fits healthcare workloads hosted on EC2 and other explicitly HIPAA-eligible services under an executed BAA, and PCI environments where the buyer needs AWS infrastructure attestations and can maintain its own cardholder-data environment and PCI controls (ChatGPT platform-reported). It also fits teams that want to scale from a small deployment to a larger regulated architecture without a platform migration (ChatGPT platform-reported).

Platforms that rated AWS as a good fit emphasized the same profile: teams with cloud engineering capability, buyers comfortable with the shared-responsibility model, and organizations that need strong compliance documentation and broad service coverage rather than the cheapest managed option (Claude, Perplexity platform-reported).

Probably Not Best Suited For

Questions explored

• Who should not choose Amazon Web Services for HIPAA or PCI compliance hosting?
• Is Amazon Web Services a bad fit for a practice with no IT staff?

AWS is probably not best suited to a practice or retailer seeking a turnkey hosting plan that automatically satisfies HIPAA or PCI. It is a poor fit for organizations without staff or budget for secure AWS configuration, logging, patching, identity management, backups, vulnerability management, and audit preparation (ChatGPT platform-reported). It is also unsuitable for PHI workloads proposed for Lightsail unless AWS confirms the service's HIPAA eligibility and contractual coverage in writing (ChatGPT platform-reported).

Platforms that rated AWS as mixed named the same exclusions: small practices without dedicated IT or cloud engineering staff, buyers seeking a fixed-price all-inclusive plan, organizations requiring vendor-managed security monitoring and incident response, and users needing bundled BAA, encryption, and audit documentation without self-configuration (DeepSeek, Grok, Kimi, Gemini platform-reported). One platform noted that AWS provides zero hands-on compliance configuration assistance from standard support plans and that the client carries full liability for misconfiguration (Gemini platform-reported).

When Another Option May Be Better

Questions explored

• What is a better alternative to Amazon Web Services for a small practice that lacks cloud engineering staff?
• When is a managed HIPAA hosting provider a better buy than Amazon Web Services?

A specialized HIPAA hosting provider or managed AWS partner may be better when the buyer lacks cloud engineering staff and wants configuration, monitoring, backup, and compliance evidence managed for it (ChatGPT platform-reported). A PCI-focused managed host or a payment architecture that keeps cardholder data outside the buyer's environment may be better when the main objective is minimizing cardholder-data scope (ChatGPT platform-reported).

Platforms named specific alternatives with published pricing. One platform reported Atlantic.Net HIPAA hosting from $552.31 per month with managed firewall, BAA, and backups, and MedhaCloud HIPAA cloud hosting from $99 per month with BAA included and PCI from $149 per month ^[27]. Another platform reported that Atlantic.Net offers HIPAA hosting from $552.31 per month with BAA, firewall, backups, and vulnerability scans included, and that MedhaCloud starts at $99 per month for HIPAA with BAA included (Kimi platform-reported). These are company-owned claims from the vendors themselves and were not independently verified.

A simpler managed application platform may be better when the buyer needs predictable pricing and turnkey administration and does not require general-purpose AWS infrastructure (ChatGPT platform-reported). Buyers who selected Lightsail expecting HIPAA compliance should switch to EC2 or another eligible service (Claude platform-reported).

Questions to ask before choosing a provider

Will AWS execute the BAA for the intended contracting entity, and which AWS accounts and services will it cover? (ChatGPT platform-reported)

Is every service that will create, receive, process, maintain, or transmit PHI included in the current HIPAA-eligible list? (ChatGPT platform-reported)

If considering Lightsail, will AWS confirm its HIPAA eligibility and BAA coverage in writing? (ChatGPT platform-reported)

Which party will configure encryption at rest and in transit, key management, IAM, MFA, audit logging, backups, retention, patching, incident response, and disaster recovery? (ChatGPT platform-reported)

For PCI, exactly which components are in the cardholder-data environment, and which AWS controls can the QSA rely on from AWS's current AOC and responsibility summary? (ChatGPT platform-reported)

What is the estimated monthly bill including compute, storage, backups, data transfer, monitoring, security services, support, and taxes? (ChatGPT platform-reported)

Does the buyer's team have cloud engineering capability to configure EC2, KMS, IAM, CloudTrail, and security groups for HIPAA compliance? (Claude platform-reported)

Have separate BAAs been obtained from every other vendor that will touch PHI, including EHR, email, and payment processors? (Claude platform-reported)

Will AWS Artifact allow BAA execution on the buyer's account tier, or is an upgrade required? (Kimi platform-reported)

For PCI, does the buyer need SAQ-A, SAQ-A-EP, or SAQ-D, and which AWS architecture supports the required level? (Kimi platform-reported)

The consensus assessment

AWS is a mixed fit for the stated entry-level buyer. EC2 with an executed BAA is a credible foundation for HIPAA hosting, and AWS provides strong PCI documentation and infrastructure controls. It is not a turnkey legally compliant hosting plan: the buyer must design, configure, operate, document, and validate the environment. AWS is strongest when the small organization has competent technical support or a managed AWS partner; otherwise, a specialized managed compliance-hosting provider or a payment architecture that keeps card data outside the buyer's environment is likely better.

Two of seven platforms named AWS in the ranking stage, and fit ratings split between good and mixed. That split is the finding: AWS is capable, documented, and inexpensive at the infrastructure layer, but the compliance work is the buyer's. Platform agreement on that point does not prove product quality; it reflects how the platforms read AWS's own published responsibility model.

How This Review Was Produced

This review was produced from seven AI platform responses collected for the research question on entry-level HIPAA or PCI hosting for a small healthcare-adjacent practice. Each platform returned a fit assessment, use-case findings, pricing and terms, limitations, and questions to verify before buying. Two platforms named Amazon Web Services during the ranking stage. The article reports platform agreement, disagreement, and uncertainty as supplied, and labels platform-reported claims where no citation was provided. Company-owned citations materially outnumber independent citations in the supplied evidence, so AWS's own compliance claims are described as company statements rather than independently verified facts.

Research limitations

The supplied URLs were collected from platform responses and were not independently validated by the writer stage. Citations are platform-reported evidence, not independently verified facts. Company-owned citations materially outnumber independent citations, so company claims should not be read as independently verified. Platform-reported research dates differ from the authoritative run date of 2026-10-03; one platform's research date was 2026-01-16, and that platform also ran without search enabled, so its claims require explicit verification before being described as current facts. Exact AWS cost cannot be verified without workload, region, traffic, storage, backup, retention, support, and security-service assumptions. AWS publishes service eligibility and infrastructure attestations, but those materials do not prove that a specific customer deployment is HIPAA- or PCI-compliant. The Lightsail eligibility conflict remains unresolved in the supplied evidence. This review covers United States compliance expectations and does not evaluate regional variations.

See the broader HIPAA or PCI Compliance Needs consensus index for comparisons across qualified options.

Explore more shared and small business web hosting guidance in the category directory.

Sources

Company-Owned Sources

1. AWS Artifact: https://aws.amazon.com/artifact/
2. HIPAA compliance for generative AI solutions on AWS: https://aws.amazon.com/blogs/industries/hipaa-compliance-for-generative-ai-solutions-on-aws/
3. Frequently Asked Questions About HIPAA Compliance in the AWS Cloud: Part Two: https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud-part-two/
4. Spring 2026 PCI DSS and PCI 3DS compliance packages for AWS now available: https://aws.amazon.com/blogs/security/spring-2026-pci-dss-and-pci-3ds-compliance-packages-for-aws-now-available/
5. AWS Compliance - Amazon Web Services (AWS: https://aws.amazon.com/compliance/
6. Data Encryption - Amazon Web Services (AWS: https://aws.amazon.com/compliance/data-encryption/
7. HIPAA Compliance - Amazon Web Services: https://aws.amazon.com/compliance/hipaa-compliance/
8. HIPAA Eligible Services: https://aws.amazon.com/compliance/hipaa-eligible-services-reference
9. PCI DSS Compliance - Amazon Web Services (AWS: https://aws.amazon.com/compliance/pci-dss-level-1-faqs/
10. PCI DSS FAQs: https://aws.amazon.com/compliance/pci-faqs/
11. Payment Card Industry Data Security Standard - Services in Scope: https://aws.amazon.com/compliance/services-in-scope/PCI/
12. Shared Responsibility Model - Amazon Web Services (AWS: https://aws.amazon.com/compliance/shared-responsibility-model/
13. Amazon EC2 Pricing: https://aws.amazon.com/ec2/pricing/
14. Healthcare Compliance: https://aws.amazon.com/health/healthcare-compliance/
15. Amazon Lightsail - Amazon Web Services (AWS: https://aws.amazon.com/lightsail/
16. Amazon Lightsail Pricing: https://aws.amazon.com/lightsail/pricing/
17. AWS Pricing - Amazon Web Services (AWS: https://aws.amazon.com/pricing/
18. AWS Security, Identity, & Compliance: https://aws.amazon.com/products/security/
19. HIPAA Eligible Services Reference: https://aws.amazon.com/tr/compliance/hipaa-eligible-services-reference/
20. Architecting for HIPAA Security and Compliance on Amazon Web Services: https://d1.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.b97af4d3b25c49b662f203bccbbb624ec1ecb810.pdf
21. Architecting for HIPAA Security and Compliance on Amazon Web Services: https://d1.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf
22. Billing and account management - Amazon Lightsail: https://docs.aws.amazon.com/en_en/lightsail/latest/userguide/amazon-lightsail-frequently-asked-questions-faq-billing-and-account-management.html
23. Modernizing your healthcare-data strategy: https://docs.aws.amazon.com/pdfs/prescriptive-guidance/latest/strategy-modern-healthcare-data/strategy-modern-healthcare-data.pdf
24. Compliant Cloud Hosting | HIPAA, PCI-DSS, SAP, ERP | Medha Cloud: https://medhacloud.com/cloud-hosting/specialty-hosting
25. HIPAA Hosting Services | Secure Healthcare Cloud Hosting: https://revion.com/hipaa-hosting/
26. Compliance Hosting | Fully Compliant Hosting Solutions | Atlantic.Net: https://www.atlantic.net/compliance-hosting/
27. HIPAA-Compliant Hosting | 2026 Award Winning HIPAA Hosting: https://www.atlantic.net/hipaa-compliant-hosting/
28. Security and Compliance Hosting | Nexcess: https://www.nexcess.com/platform/security-compliance-hosting/
29. Official pricing and terms source: https://aws.amazon.com/
30. Official pricing and terms source: https://aws.amazon.com/pricing/?nc2=h_pr_hub
31. Official pricing and terms source: https://aws.amazon.com/savingsplans/?nc2=h_pr_sp

Independent Sources

32. AWS HIPAA BAA: Yes, Self-Serve in Artifact (2026: https://baagenerator.com/blog/does-aws-sign-a-baa
33. AWS HIPAA Compliance: Eligible Services & BAA Guide (2026: https://castanedanetworks.com/blog/hipaa-compliance-aws/
34. AWS HIPAA Eligible Services: RDS, S3, Lambda, Bedrock 2026: https://hipaacomplianthosting.com/blog/aws-hipaa-eligible-services
35. HIPAA compliant app hosting: who signs a BAA in 2026: https://hipaacomplianthosting.com/blog/hipaa-compliant-app-hosting
36. AWS HIPAA-Eligible Services: All 174, Read for Healthcare: https://patient-protect.com/aws-hipaa-eligible-services
37. Is AWS HIPAA Compliant? Yes - With a BAA + 7 Required Settings (2026: https://patient-protect.com/post/is-aws-hipaa-compliant
38. AWS Compliance Certifications: The Complete Guide: https://securitycomplianceguide.com/blog/aws-compliance-certifications/
39. PCI Compliance AWS: Shared Responsibility & Scanning Guide: https://secusyasv.com/pci-compliance-aws/
40. What is a BAA and why is it necessary with AWS?: https://www.accountablehq.com/post/aws-baa-hipaa-compliance
41. Security and Compliance Responsibilities on AWS: https://www.accountablehq.com/post/aws-shared-responsibility-hipaa
42. How to Get a BAA with AWS: Steps, Requirements, and Covered HIPAA Services: https://www.accountablehq.com/post/how-to-get-a-baa-with-aws-steps-requirements-and-covered-hipaa-services
43. Does AWS Sign a HIPAA Business Associate Agreement?: https://www.baagenerator.com/aws-hipaa-baa
44. How to Build for HIPAA Compliance on AWS: https://www.censinet.com/blog/hipaa-compliance-on-aws
45. AWS HIPAA Cost in 2026: https://www.hipaacompliancecost.com/aws-hipaa-cost
46. Is AWS HIPAA compliant?: https://www.hipaacomplianthosting.com/is-aws-hipaa-compliant
47. HIPAA Business Associate Agreement - 2026 Update: https://www.hipaajournal.com/hipaa-business-associate-agreement/
48. AWS HIPAA compliance checklist for modern healthtechs: https://www.justaftermidnight247.com/insights/aws-hipaa-compliance-checklist-healthtechs/
49. Which Cloud for HIPAA? AWS vs Azure vs GCP (2026: https://www.ofashandfire.com/blog/hipaa-compliant-cloud-architecture-aws-azure-gcp
50. Is Amazon Web Services (AWS) HIPAA compliant? (2026 update: https://www.paubox.com/blog/amazon-web-services-aws-hipaa-compliant
51. AWS Secrets to HIPAA-Compliant Healthcare Apps: https://www.themomentum.ai/blog/aws-secrets-to-hipaa-compliant-health-applications