That's the exact whitepaper I read, but it falls short of explicitly stating that they are HIPAA compliant. You see, HIPAA requires a certain amount of physica

That's the exact whitepaper I read, but it falls short of explicitly stating that they are HIPAA compliant. You see, HIPAA requires a certain amount of physical security (on premises at the data-center) on top of all of that electronic security, and Amazon won't publish it all in detail. It also requires the "hosting provider" to sign the aforementioned BAA, which Amazon won't do. Amazon is of the mindset that they are providing an "infrastructure" and not a hosting service, but that is a murky legal gray area that could see me fined hundreds of thousands, even millions of dollars if they are wrong. They even put it in the disclaimer: "AWS and its affiliated entities make no representations or warranties that your use of AWS services will assure compliance with applicable laws, including but not limited to HIPAA and HITECH."