Amazon Quick becomes HIPAA-eligible for health data

The announcement arrives as agentic AI changes what it means for software to "touch" protected health information. A traditional analytics tool reads data and returns a response, but a workspace like Amazon Quick can retrieve from unstructured and structured sources, call other systems through connectors, and complete multi-step tasks—which is why AWS pairs eligibility with governance features like ACL-aware retrieval, chat and feedback logging, and controls over what each agent may do.

AWS draws a sharp line between HIPAA-eligible, its own designation for a service it permits to process, store, and transmit PHI under a signed BAA, and HIPAA-compliant, a property of the customer's entire environment. A set of decisions are flagged as irreversible and must be made before resources are created or users onboarded—most notably the encryption key, which is set once on first data creation and cannot be changed later. Because a few of these decisions cannot be undone, the guidance is to settle them up front.

The described pattern deliberately splits responsibilities: de-identification, ETL, and lake-level grants happen upstream in AWS Glue, AWS Glue DataBrew, and AWS Lake Formation, while Amazon Quick enforces identity, retrieval, guardrails, and the audit trail. The post also notes a nuance for PHI handling—user feedback on chat responses isn't encrypted with the customer managed key or the key protecting Amazon Quick's AI-indexed data, so it should be treated as a potential PHI surface.