> Now all Amazon needs to do is make Aurora HIPAA compliant/offer to sign a BAA and the dump trucks full of money will be backing up in no time. Can I dream? A

> Now all Amazon needs to do is make Aurora HIPAA compliant/offer to sign a BAA and the dump trucks full of money will be backing up in no time. Can I dream? Amazon already signs BAAs that cover EC2 dedicated instances and S3. Or do you mean BAAs that cover Aurora specifically? FWIW, unless you're already a rather large company with excess capacity in both the engineering and legal teams, I'd recommend skipping AWS entirely and using a company like Aptible (YC S'14) to handle hosting and compliance[0]. It's more or less like using Heroku, except you have all of the compliance requirements (including legal documentation) managed for you. Having tried both approaches myself, I can testify that the latter is by far the preferable alternative (and honestly cheaper in the long run). [0] Like Heroku, Aptible uses AWS under the hood, so it's not really "skipping" AWS, but you never have to deal with it directly (and that's a good thing).