[p0rkbelly]

PSA: In exposures like this, Contact the cloud provider too. They tend to have the right contacts for customers. And I'm guessing there are actions they can take as well.

[throwawaaarrgh]

Yeah, you have to digitally sign a Business Associate Addemdum in your AWS account to handle HIPAA data in it. If they didnt, they're double screwed