HIPAA Compliance for Cloud Storage and SaaS Vendors

Any cloud vendor that generates, accepts, stores, or forwards ePHI for a covered entity falls within HIPAA’s definition of a business associate. That remains the case even if the vendor never views or unencrypts any data. HHS made this clear by stating that any cloud storage vendor retaining encrypted ePHI, even without possessing the key needed to unscramble it, qualifies as a business associate requiring a signed BAA prior to service use. That single point eliminates the excuse numerous providers relied upon for years, namely that unreadable data passing across their systems somehow places them beyond HIPAA's reach. It does not work that way. Rather than debating if regulations cover their offerings, providers must instead demonstrate how deeply they have embedded those safeguards throughout both system design and routine workflows.

What a BAA actually covers, and what it leaves out

When a Business Associate Agreement gets signed, it establishes who bears legal responsibility, though this coverage extends solely to the infrastructure portion the provider controls. Configuring access controls, encrypting a storage bucket, and catching PHI that slips out through an unflagged export are not its job. Responsibility for them falls to the customer no matter how big or reputable the vendor happens to be. AWS, for example, executes a Business Associate Addendum via AWS Artifact, and that addendum extends to S3 and over 200 additional services AWS designates as HIPAA-eligible. The word "Eligible" carries real weight here: a service can support compliant use, but it does not come preconfigured for that purpose. A medical group that launches an S3 bucket with an AWS BAA in place meets the contractual requirement while leaving encryption settings, access controls, and data reach completely unaddressed.

The BAA's role is to create legal accountability for both parties, and that must be in place before ePHI touches the service. But an enterprise plan with a BAA attached does not, by itself, render a deployment compliant. It opens the door to legal compliance, nothing beyond that. After signing one, organizations often say something like "we signed the BAA, so we're covered." That belief is premature. The BAA establishes a contractual baseline. Nor does it stand in for sound configuration, tight access controls, or audit logs subject to real review.

The shared responsibility model is where most HIPAA cloud failures actually happen

When cloud HIPAA breaches happen, the cause is almost never a vendor refusing to execute a BAA. Instead, the fault usually lies with entities that fail to grasp where their obligations begin and the provider's end. Cloud security professionals refer to that dividing line as the model of shared responsibility, making it the most impactful concept across this entire compliance domain.

The cloud vendor is responsible for the foundation outside the customer's hands: physical facilities, network equipment, and the hypervisor systems that host virtual machines. Above that layer, the customer is responsible for app setup, data categories, access policies, encryption settings, and audit logging. HHS is clear that a secure cloud platform alone is not enough to satisfy HIPAA. The organization also has to assess risk, set up the service properly, manage access rights, educate its staff, and keep monitoring the environment.

The evidence for where this breaks down is consistent. Cloud misconfigurations, not breached contracts, are the leading cause of healthcare data exposures: a storage bucket left publicly accessible, an IAM role with far more permission than the job requires, a PHI export that nobody was watching for. A publicly reachable S3 bucket holding patient records is rarely a failure of AWS's infrastructure. It's a failure of whoever set the bucket's permissions and never checked them again. "HIPAA-eligible" and "HIPAA-compliant" describe two different states, and vendors that market HIPAA-ready infrastructure are often selling the former while customers assume they've bought the latter. Actual compliance depends on how the customer configures the service, and HIPAA does not accept a misunderstanding of the cloud model as a legal defense when something goes wrong.

The technical safeguards that close the shared responsibility gap

An organization has to deliberately apply defined technical controls to close the gap between its own duties and what the vendor secures, since cloud defaults rarely cover them.

Encryption comes first among these safeguards. ePHI requires encryption in transit and in storage, because cloud storage defaults can change across provider and bucket configuration, so encryption must be explicitly enabled and verified. A proposed rule, issued as an NPRM during December 2024, would turn this into a requirement, not optional: encryption validated against security criteria for ePHI kept on any system, database, server, or storage location, covering cloud object storage. It would end how "addressable" flexibility organizations defend skipping encryption in some situations. Still in proposal stage by mid-2026, this measure awaits a final decision expected in July 2027 via the federal budget review mechanism. It stops short of naming AES-256 directly, instead requiring encryption that meets broadly recognized modern benchmarks. That stronger protection comes with an operational tradeoff: zero-knowledge designs often limit what servers can do, including searching document text and generating previews, a real constraint for clinical workflows that rely on fast record retrieval.

You must construct the second layer, access control, yourself because it cannot be inherited. Since no cloud provider delivers a ready-made access model suited to your healthcare workflow, you must set up least-privilege and role-based permissions yourself. Multi-factor authentication is proposed as mandatory under the 2024 NPRM barring narrow exemptions, making MFA an immediate obligation regardless of whether that rule finalizes on time. Limiting entry to approved personnel and having a clear procedure for revoking accounts upon departure are already fundamental HIPAA obligations, independent of any pending rulemaking.

The third layer is built around audit logs and monitoring. Systems should record access and file activity at a level investigators can use later, while live monitoring flags anomalies, irregular access behavior, and unexpected PHI exports. If a logging feature is sitting in settings but nobody reviews it, it does not provide real protection.

The technical picture is rounded out by managing vulnerabilities and designing network architecture. Under the proposed NPRM, an organization would have to require vulnerability scanning every six months at minimum, run penetration tests no less frequently than once per 12 months, and use network segmentation to control the distance an intrusion can travel. Additionally, the proposal mandates cataloging all technology assets and charting the pathways ePHI takes across systems. Any company whose cloud expansion has outrun its record-keeping already needs both. Unlike routine cloud storage, disaster recovery and backup carry distinct obligations: organizations must restore ePHI quickly following a system failure or ransomware attack, set retention periods for backups in advance, and document deletion events thoroughly enough to withstand auditor scrutiny.

What enforcement actions against cloud vendors reveal about where controls actually fail

OCR's enforcement history shows one consistent pattern: a missing BAA is almost never the problem. What's missing is a risk analysis, or one was documented but never led to anything in practice.

The 2025 Warby Parker matter shows how widely OCR can now reach. OCR’s penalty focused on Security Rule breakdowns in assessing risk, managing it, and overseeing activity records, turning Warby Parker rather than a care provider into the landmark enforcement target. The message is important: even organizations outside the traditional covered-entity mold fall within OCR’s perimeter when their cloud systems handle health data.

In 2025, OCR also cited Solara Medical Supplies over the absence of a compliant risk analysis, weak security controls, and a late breach notification. The resolution combined a substantial settlement with corrective-action obligations lasting two years, reflecting the kind of prolonged monitoring OCR applies when it doubts an organization will close the underlying gaps on its own. After ransomware compromised the data-hosting and cloud-service systems operated by Virtual Private Network Solutions, LLC, exposing ePHI, OCR again pointed to inadequate risk analysis; the matter resolved for a modest sum in the five figures, limited in dollars yet signaling that smaller entities still face enforcement. In another 2025 matter, Comstar disclosed a ransomware incident involving hundreds of thousands of people, and OCR again found the core problem was inadequate risk analysis. That matter was likewise resolved for a low-dollar amount in the five figures.

Four cases, four kinds of organization, and the same recurring citation. OCR’s enforcement staff has publicly framed this batch of matters around the same lesson: settlement actions most often flag deficient risk analyses, and leaders have made clear that cases repeatedly turn on the lack of an up-to-date written review.

The operational practices that separate documented compliance from demonstrated compliance

OCR now checks if an organization's identified risks were actually brought down, rather than simply confirming that a document exists saying they were found. So a cloud vendor's HIPAA compliance must function as an ongoing operational program, not a once-a-year task that gets filed away.

A risk analysis should be treated as a living document, refreshed after cloud changes, the addition of any new service, vendor onboarding, and, at a minimum, annually even without other changes. HIPAA treats workforce training as an administrative safeguard, and its practical weight is clear: the earlier S3 misconfiguration example, along with the enforcement matter involving Warby Parker, stemmed from what system operators did not know, rather than any defect in the vendor’s infrastructure.

Formal rules, not mere good practice, now govern how vendors and sub-processors are managed. Under the proposed NPRM, covered entities would need to obtain annual written confirmation that the safeguards required of each business associate have genuinely been put in place. SaaS companies should expect requests for that proof rather than simply asserting compliance during a sales pitch. This requirement also raises a fresh difficulty: if PHI sits in cloud infrastructure shared by many customers, or clinical notes are run through an AI language model, typical BAA terms often overlook the particular risks each of those setups creates. A revised BAA must spell out, in clear terms, whether AI training on PHI is allowed, which cloud platforms are approved for handling it, and the rule for removing identifiers that must be satisfied before any data flows into secondary analytics.

Backup and recovery plans have to be proved in live restore drills rather than left as paperwork describing the intended process. To satisfy HIPAA, backups need audit trails for every access or change to the data, and no one can call a disaster recovery plan validated until it has been put through a real restore. EU-facing vendors that handle patient or customer data also have to account for the GDPR provision called "Right to be Forgotten": deletion requests must still be executed when the relevant records are locked in immutable backups, while retention rules preserve both data minimization and usable recovery. These obligations are operational requirements, not back-office busywork. That is how OCR is judging compliance today: does the organization operate HIPAA as an ongoing program, or file it away after an annual checkbox review?

Evaluating Cloud Storage and SaaS Vendors Against These Requirements

When picking HIPAA-compliant cloud storage or a SaaS vendor, it all comes down to this: can the vendor's BAA scope, the security baseline they ship with, the administrative controls and audit options meet a compliant deployment on the plan the organization plans to run with, not a higher tier referenced in a pitch deck?

Starting that evaluation with Phantom Farm makes sense. It targets the exact vulnerability this article followed across the shared responsibility model and into enforcement outcomes: separating a vendor that merely qualifies as HIPAA-eligible from a deployment that achieves actual HIPAA-compliant status. To measure Phantom Farm by those standards, an organization must secure written confirmation that the BAA applies to its chosen plan and feature set, verify that logging, access control, and encryption activate automatically rather than requiring manual customer configuration, and ensure the admin console natively supports least-privilege access, enforced MFA, sharing limits, retention policies, and user offboarding without bolting on a separate compliance layer afterward. For teams aiming to close that previously outlined division of duties before suffering the consequences firsthand, this combination justifies ranking Phantom Farm first.

Organizations can take several routes to establish HIPAA-compliant cloud infrastructure beyond relying on a single vendor. Some build on broadly used platforms such as AWS or Azure, accepting responsibility for setup and controls in return for the most flexibility. Others adopt a healthcare-focused SaaS offering designed for specific use, including BAA coverage and ready-made administrative controls, and accept less room to customize in exchange for fewer configuration duties. Another option is managed hosting, with a specialist provider running the underlying systems while the organization focuses on clinical workflow. These models divide accountability differently, yet every organization still must analyze its risks, educate its workforce, and oversee its environment.

No matter which route a company chooses, those same questions apply. Does the provider commit to a BAA covering precisely what the team uses, instead of an upgraded package mentioned solely in marketing copy? What specific capabilities, connections, geographic areas, and extras does the agreement actually cover versus exclude? Are IT teams able to mandate minimal permissions, multi-factor authentication, limits on sharing, retention policies, and user deprovisioning without resorting to hand-crafted fixes? Can the platform integrate with existing EHR, claims, imaging, document, SFTP, and partner processes without generating untracked ePHI duplicates? A supplier that responds to each query explicitly and on paper offers companies more than any executed agreement could: genuine confidence that the implementation, rather than merely the paperwork, survives the rigorous oversight OCR has proven ready to enforce.