AWS bedrock Anthropic Foundational Models HIPAA Compliance

Thank you for your reply. 'Is there any documentation that specifically mentions input types and model names and their compliance? I want to make sure that sending images containing PHI are covered by HIPAA BAA in bedrock. We will make sure our other stacks are compliant as well.

Unfortunately the compliance is not shared at a model level AFAIK. The working assumption is that if the service will not be compliant, unless all the models included are compliant.

Hope this helps.

To add to Mukuls answer, Bedrock is covered under the AWS BAA. When a sub product is not included in the BAA, you would see an exclusion notice (E.g., AWS Directory Service is listed but excludes sub product Simple AD. Bedrock has no exclusions). Bedrock architecture isolates the model from the vendor within an AWS service team controlled environment. There is no egress to, access and/or processing by third party vendors. For example, if you use Claude on Bedrock, Anthropic cannot see inputs and outputs, and cannot see or access customer data. As long as the customer is abiding to the AWS BAA, and configurations are inline with AWS guidance, the AWS BAA should cover Anthropics models within Bedrock. AWS BAA would not cover Anthropic if you are using their public API (I.e., Claude Developer Platform). This is due to egress from an AWS customer controlled or service team environment (which the AWS BAA covers) to an uncontrolled environment (owned/managed by Anthropic). Therefore, if you are using the Anthropic managed Claude Developer Platform, you will most likely need a BAA with Anthropic. Ultimately, customers legal team will need to review and confirm an answer inline with the customers usecase.