[throwawaaarrgh]

Yeah, you have to digitally sign a Business Associate Addemdum in your AWS account to handle HIPAA data in it. If they didnt, they're double screwed