I don't see how this can work at all if Amazon has access to your keys but doesn't sign a Business Associate Agreement under HIPAA. They've refused to do this

I don't see how this can work at all if Amazon has access to your keys but doesn't sign a Business Associate Agreement under HIPAA. They've refused to do this for us. It might be viable to encrypt yourself and keep the keys, because then you're not giving them PHI---just goblety gook.