HIPAA Compliance in the Cloud: Who Owns What and How to Prove It

TL;DR: HIPAA compliance in the cloud means protecting ePHI to HIPAA’s standards while it lives on someone else’s servers. Your cloud provider must sign a business associate agreement (BAA), but that covers only half the work. Your settings, your user access, and your proof stay with you. Teams that pass audits check their cloud setup regularly and keep evidence up to date as they go.

In 2025, US health groups reported 772 large data breaches to HHS, a new record. More than 80% of them came from hacking and other IT incidents. Much of that patient data now sits in the cloud, and the rules for protecting it didn’t get lighter when it moved.

What Is HIPAA Compliance in the Cloud?

HIPAA compliance in the cloud means meeting the HIPAA Privacy, Security, and Breach Notification Rules for any ePHI you store, process, or send through a cloud service.

HIPAA never mentions the cloud by name. The law dates back to 1996, long before most health data moved onto rented servers.

So the rules stay the same in the cloud. What changes is who does each part of the work, and how you prove it got done.

HHS guidance confirms that covered entities and business associates can use cloud services for ePHI. They need a BAA with the provider and their own risk analysis of the cloud setup first.

Who Is Responsible for HIPAA Compliance in the Cloud?

You and your cloud provider share the work. This split is called the shared responsibility model.

The provider protects the hardware, the data centers, and the core network. You protect everything you put on top, including your data, your user accounts, and your settings.

That split matters because many cloud exposures start on the customer side. A storage bucket left open to the internet or an admin account with no multifactor login is your problem, not the provider’s.

IaaS, PaaS, and SaaS: Where the Line Moves

IaaS stands for Infrastructure as a Service. You rent servers, storage, and networks, and you manage almost everything that runs on them.

PaaS stands for Platform as a Service. The provider runs the operating system and runtime, and you manage your apps and data.

SaaS stands for Software as a Service. The provider runs the whole app, and you manage who can log in and what data goes in.

In every model, your data and your user access stay your job.

Is a Cloud Provider a Business Associate?

Yes. HHS says a cloud provider that creates, receives, keeps, or sends ePHI for you is a business associate.

That holds even when the provider only stores encrypted data and has no key to read it. HHS calls these “no view” services, and they still need a BAA.

Cloud providers also cannot claim the conduit exception. That exception covers services that only pass data along, like a mail carrier, and not services that store it.

Skipping the BAA gets expensive. Oregon Health & Science University paid $2.7 million to settle an OCR case that included storing the ePHI of more than 3,000 people on a cloud server with no BAA in place.

What HIPAA Requires From Your Cloud Setup

The Security Rule asks you to protect the confidentiality, integrity, and availability of ePHI. Put simply, keep it private, keep it accurate, and keep it ready when care teams need it.

The rule sorts this work into administrative, physical, and technical safeguards. In the cloud, the provider handles most physical safeguards, and you own the rest.

Administrative Safeguards

These are the policy and people controls behind your cloud use.

• Run a risk analysis that covers every cloud account holding ePHI
• Name a security official who owns HIPAA work
• Train staff on how to handle ePHI inside cloud tools
• Write a plan for backups, outages, and incidents
• Keep a signed BAA with every vendor that touches ePHI

OCR keeps finding gaps in risk analysis. The agency has run an enforcement push, called the Risk Analysis Initiative, aimed at groups that never mapped risks to their ePHI.

Technical Safeguards

These are the controls you set inside your cloud accounts.

• Access control: give each person a unique login and only the access they need
• Audit controls: log who viewed or changed ePHI, and review those logs
• Integrity: stop or detect unwanted changes to records
• Authentication: confirm users are who they say they are, ideally with multifactor login
• Transmission security: encrypt ePHI as it moves across networks

Encryption is “addressable” under today’s Security Rule, which does not mean optional. You either encrypt or write down why another control protects the data equally well. HHS has proposed making encryption required, but that update is not final yet.

HIPAA Cloud Storage and Databases

HIPAA-compliant cloud storage is not a product you buy off a shelf. It is storage you set up and run the right way.

That means a BAA that covers the exact service you use, encryption at rest and in transit, tight access rules, enabled logs, and tested backups.

Databases need the same care, plus close tracking of copies. ePHI tends to spread into test systems, analytics tools, and old backups that nobody watches.

One OCR case shows how this goes wrong. A business associate’s server misconfiguration left ePHI open to web crawlers, and the company did not complete a risk analysis until years after the exposure.

Three HIPAA Cloud Myths That Get Teams Fined

Myth 1: A signed BAA makes you compliant. A BAA sets the rules between you and the provider. It does not turn on your access controls, logs, or encryption.

Myth 2: Cloud apps are exempt from HIPAA because no ePHI is stored on site. HHS has rejected this idea. HIPAA follows the ePHI, so where the server sits does not change your duties.

Myth 3: There is an official HIPAA certification for the cloud. No government body certifies cloud services for HIPAA. A “HIPAA certified” badge is a marketing claim, so ask for the BAA and the provider’s responsibility matrix instead.

HIPAA Cloud Compliance Checklist

Use this list to check your setup, and keep proof for each step.

1. Find every place ePHI lives, including test systems and backups.
2. Sign a BAA with each provider for each service that touches ePHI.
3. Run a risk analysis of your cloud setup, and redo it after big changes.
4. Lock down access with least privilege and multifactor login.
5. Encrypt ePHI at rest and in transit, and track who holds the keys.
6. Turn on audit logs and review them on a set schedule.
7. Test backups and restores so you know the data comes back.
8. Write and practice a breach response plan.
9. Watch for configuration drift and fix it fast.
10. Keep dated evidence for every step above.

Why Once a Year Audits Fall Short in the Cloud

Cloud setups change every day. New accounts, new storage, new users, and new code ship all the time.

A risk analysis from last spring cannot describe a system that looks different today. That gap is where open buckets and forgotten admin accounts hide.

Continuous HIPAA compliance monitoring closes the gap. You check settings as they change, fix drift quickly, and save proof along the way.

So when an auditor asks how you protect ePHI, you show records from this week instead of a spreadsheet rebuilt the night before.

How Secure.com Helps With HIPAA Compliance in the Cloud

HIPAA asks you to protect ePHI and prove it, over and over. Secure.com runs that loop alongside your security team: Attack. Harden. Prove. Repeat.

• The Cloud Security Teammate flags risky cloud settings, like open storage or admin accounts without multifactor login.
• The Red Teammate tests your cloud the way an attacker would, so gaps show up before a breach does.
• The SOC Teammate watches for odd access to systems that hold ePHI and triages alerts fast.
• Fixes that touch production wait for human approval, so speed never costs you control.
• Every test and fix is logged, so you can hand auditors dated proof instead of a ticket that says “done.”

FAQs