Deploy AI in a HIPAA-eligible environment with Amazon Quick

What happened

AWS explains how to deploy Amazon Quick for healthcare workflows involving protected health information, distinguishing HIPAA eligibility from deployment compliance. The guide covers BAA acceptance, separate controls for structured and unstructured data, agent permissions, and audit logging. It emphasizes configuring encryption keys, identity, and document access before deployment, then validating safeguards before expanding from non-PHI to PHI-adjacent workflows.

Read next

• More changes in today’s briefingMicrosoft Research and Collaborator Resolve the KLS Conjecture With Human-Directed AI

The story so far

AWS published a guide for deploying Amazon Quick in healthcare workflows involving protected health information (PHI), emphasizing that HIPAA eligibility does not make a customer’s deployment compliant. AWS says eligibility covers Quick’s web, desktop, and mobile clients, subject to configuration and shared responsibility. However, only the web version provisioned through the AWS Management Console can be covered by a signed business associate agreement (BAA) through AWS Artifact—a necessary component for HIPAA-compliant workflows involving PHI. The Free and Plus paths do not offer a BAA. The guide assigns customers responsibility for configuring safeguards, including encryption keys, identity controls, document access, agent permissions, and audit logging, with separate controls for structured and unstructured data. Customer-managed encryption keys require an Enterprise subscription. AWS recommends validating safeguards before expanding from workflows without PHI to PHI-adjacent workflows.