[rficcaglia]

Where in the CFR does it say you have to use physical servers or even dedicated cloud instances? AWS will sign a BAA for dedicated instances only (biz policy, not for any valid security reason), but dedicated servers are not required by HIPAA.

[Merrack]

The requirement for dedicated instances was lifted earlier this year. See https://aws.amazon.com/blogs/apn/aws-hipaa-program-update-re... for more info.

[rficcaglia]

Thank you! Slipped by my addictive refresh of What’s New!