Is there any documentation on how AWS Bedrock can be HIPAA eligible in more detail?

Hi John

You're right in that data doesn't leave the AWS service or go back to the model vendor. To quote the documentation:

"Each model provider has an escrow account that they upload their models to. The Amazon Bedrock inference account has permissions to call these models, but the escrow accounts themselves don't have outbound permissions to Amazon Bedrock accounts. Additionally, model providers don't have access to Amazon Bedrock logs or access to customer prompts and continuations."

There is also this resource for compliance validation.

Hopefully this helps!