Independent vendor compliance review
Is AWS Lambda HIPAA compliant?
AWS Lambda may support HIPAA-regulated workloads when the relevant account is covered by the AWS BAA and the complete function data path is reviewed. AWS lists Lambda as HIPAA eligible, but payloads, application logs, temporary files, triggers, queues, retries, traces, and downstream services still require customer controls. Function eligibility is not application certification.
Direct compliance answer
AWS Lambda HIPAA, BAA, PHI, and SOC 2 snapshot
Last checked: 2026-10-14 | Confidence: Medium
| Direct answer | AWS Lambda may support HIPAA-regulated workloads when the relevant account is covered by the AWS BAA and the complete function data path is reviewed. AWS lists Lambda as HIPAA eligible, but payloads, application logs, temporary files, triggers, queues, retries, traces, and downstream services still require customer controls. Function eligibility is not application certification. |
|---|---|
| BAA availability | Verify AWS BAA acceptance for the actual account or organization before PHI processing. Confirm current eligible services and any stated exceptions. |
| Can it handle PHI? | PHI may appear in events, responses, errors, logs, temporary files, traces, retry payloads, database writes, and external API calls. Inspect a synthetic data flow, not real patient records, during procurement review. |
| SOC 2 caveat | Request the current AWS report through AWS Artifact and verify Lambda, supporting services, report period, and exceptions. This review did not inspect a private SOC report. |
| What to verify | Account BAA, current eligible-service scope, region, and enabled features. Input/output schemas and every trigger, queue, retry, dead-letter, trace, storage, and external destination. |
Scope of this profile
Review Lambda function processing, triggers, logs, retries, temporary files, and downstream systems. Use the AWS overview for umbrella agreements and RDS for database-specific controls.
Independent research view
Lambda PHI data-path verification table
Check the success and failure paths separately; a function that avoids PHI in its normal response may still copy it into an exception or retry destination.
| Review area | Vendor public signal | Buyer verification |
|---|---|---|
| Account and services | AWS publishes Lambda eligibility and BAA guidance. | Record the agreement, account, region, and each service processing PHI, including queues and storage. |
| Payload and failure paths | Events, responses, exceptions, temporary files, and retry payloads are separate review points. | Trace a synthetic request through success, timeout, retry, and dead-letter handling; record every copy and deletion policy. |
| Logs and monitoring | Lambda can forward invocation logs to CloudWatch when the execution role permits it. | Avoid patient payload logging; review log access, encryption, retention, exports, trace fields, and support artifacts. |
| Code and integrations | Cloud eligibility is not certification of function code or external vendors. | Review IAM, secrets, deployments, outbound destinations, connected agreements, and incident ownership. |
HIPAA status signal
Conditional
BAA public signal
AWS BAA required
SOC 2 evidence signal
Verify current AWS report scope
PHI warning: PHI may appear in events, responses, errors, logs, temporary files, traces, retry payloads, database writes, and external API calls. Inspect a synthetic data flow, not real patient records, during procurement review.
Search query answers
Is AWS Lambda HIPAA compliant?
Lambda is listed as HIPAA eligible by AWS, not automatically compliant for every application. Verify the AWS BAA and current service scope, then document the function's input, output, storage, logging, identity, and downstream systems before introducing PHI.
Does AWS Lambda require a BAA for PHI?
A regulated PHI workload needs the applicable AWS account covered by the AWS BAA. Confirm agreement scope and the current eligibility of every service that processes PHI; the function's agreement does not cover unrelated third-party vendors.
Can Lambda logs contain PHI?
Application logging may copy PHI from event payloads, exceptions, or responses. Lambda sends invocation logs to CloudWatch when its execution role has the required permissions. Avoid logging patient data and review log permissions, retention, encryption, exports, and monitoring destinations.
Does a Lambda BAA cover API Gateway, queues, and triggers?
Review each connected service under its own current scope and the account agreement. Draw the full route from API or event source through the function to queues, retry destinations, databases, storage, traces, and external endpoints; do not infer coverage from Lambda alone.
Does SOC 2 mean Lambda is HIPAA compliant?
No. Request current AWS assurance reports and check service scope, but assess the BAA, data paths, implementation controls, and intended PHI use separately.
HIPAA, BAA, and SOC 2 summary
| HIPAA | The AWS eligible-services list includes Lambda. Workload compliance remains a shared responsibility and requires an agreement and service-by-service architecture review. |
|---|---|
| BAA | Verify AWS BAA acceptance for the actual account or organization before PHI processing. Confirm current eligible services and any stated exceptions. |
| SOC 2 | Request the current AWS report through AWS Artifact and verify Lambda, supporting services, report period, and exceptions. This review did not inspect a private SOC report. |
| PHI risk | PHI may appear in events, responses, errors, logs, temporary files, traces, retry payloads, database writes, and external API calls. Inspect a synthetic data flow, not real patient records, during procurement review. |
| Category | HIPAA-Compliant Databases and Cloud Services: BAA Comparison |
| Last checked | 2026-10-14 |
| Confidence | Medium |
Public evidence and open questions
What public sources say
- AWS lists Lambda in its HIPAA Eligible Services Reference; this is vendor-side eligibility, not certification of customer code.
- Lambda data-protection documentation describes customer responsibilities for content, security configuration, identity, and encryption.
- Lambda can send invocation and application logs to CloudWatch Logs when the execution role has the necessary permissions.
What remains unconfirmed
- The buyer's executed BAA, region, enabled features, and exact supporting-service scope.
- Whether inputs, outputs, exception messages, temporary files, retry queues, traces, or support artifacts contain PHI.
- Third-party endpoint agreements, code behavior, retention policies, and deployment or incident procedures.
What it may be used for
- Reviewed serverless processing under the AWS BAA and a governed architecture.
- Non-PHI automation and synthetic-data development.
- Service-specific procurement review alongside RDS, Bedrock, storage, and queue profiles.
What not to use it for
- Sending PHI before agreement and service scope are verified.
- Logging full patient payloads or copying production PHI into test events without approved controls.
- Assuming a function's eligibility covers all triggers, external APIs, code, or retries.
What to verify with the vendor
- Account BAA, current eligible-service scope, region, and enabled features.
- Input/output schemas and every trigger, queue, retry, dead-letter, trace, storage, and external destination.
- IAM, secrets, encryption, temporary-file lifecycle, log retention, deletion, and monitoring.
- Synthetic test results showing where data is copied during success, timeout, retry, and failure paths.
Safer alternatives and related profiles
Safer alternatives to consider
- A reviewed AWS architecture using only appropriately scoped services, rather than a Lambda-only conclusion.
- An explicitly BAA-backed application platform after its execution, logging, storage, and integration scope is confirmed.
- A non-PHI or appropriately de-identified workflow where regulated processing cannot be supported.
AWS HIPAA eligible services and BAA scope
HIPAA: Conditional | SOC 2: Public evidence
Amazon RDS HIPAA eligibility and supported engines
HIPAA: Conditional | SOC 2: AWS public evidence
Amazon Aurora HIPAA eligibility and configuration
HIPAA: Conditional | SOC 2: AWS public evidence
Amazon Connect HIPAA contact-center eligibility
HIPAA: Conditional | SOC 2: AWS public evidence
AWS Bedrock HIPAA model and BAA checklist
HIPAA: Conditional | SOC 2: AWS public evidence
FAQ
Is AWS Lambda HIPAA compliant?
Lambda is listed as HIPAA eligible by AWS, not automatically compliant for every application. Verify the AWS BAA and current service scope, then document the function's input, output, storage, logging, identity, and downstream systems before introducing PHI.
Does AWS Lambda require a BAA for PHI?
A regulated PHI workload needs the applicable AWS account covered by the AWS BAA. Confirm agreement scope and the current eligibility of every service that processes PHI; the function's agreement does not cover unrelated third-party vendors.
Can Lambda logs contain PHI?
Application logging may copy PHI from event payloads, exceptions, or responses. Lambda sends invocation logs to CloudWatch when its execution role has the required permissions. Avoid logging patient data and review log permissions, retention, encryption, exports, and monitoring destinations.
Does a Lambda BAA cover API Gateway, queues, and triggers?
Review each connected service under its own current scope and the account agreement. Draw the full route from API or event source through the function to queues, retry destinations, databases, storage, traces, and external endpoints; do not infer coverage from Lambda alone.
Does SOC 2 mean Lambda is HIPAA compliant?
No. Request current AWS assurance reports and check service scope, but assess the BAA, data paths, implementation controls, and intended PHI use separately.
Will AWS Lambda sign a BAA?
Verify AWS BAA acceptance for the actual account or organization before PHI processing. Confirm current eligible services and any stated exceptions.
Can AWS Lambda be used with PHI?
Do not use this vendor with PHI until your organization verifies BAA scope, covered services, configuration, access controls, data retention, and connected integrations.
Does SOC 2 mean AWS Lambda is HIPAA compliant?
No. SOC 2 evidence can support security diligence, but it does not prove HIPAA compliance, confirm BAA coverage, or approve PHI use. Review HIPAA terms, BAA scope, covered services, configuration, and intended workflow separately.
What should buyers verify before using AWS Lambda with PHI?
Account BAA, current eligible-service scope, region, and enabled features. Input/output schemas and every trigger, queue, retry, dead-letter, trace, storage, and external destination. IAM, secrets, encryption, temporary-file lifecycle, log retention, deletion, and monitoring. Synthetic test results showing where data is copied during success, timeout, retry, and failure paths.
Last checked and source notes
- Last checked
- 2026-10-14
- Confidence
- Medium
- Dataset rows
- 276 vendors
- Reviewed AWS HIPAA guidance, Lambda data protection, and CloudWatch logging documentation on 2026-10-14.
- The eligible-services reference was last updated September 3, 2026. Re-check it before deployment.
- ComplySaaS did not inspect a private AWS report, executed agreement, function code, or customer configuration.
- AWS HIPAA Eligible Services Reference
- AWS HIPAA agreement guidance
- Lambda data protection
- Lambda CloudWatch logging