Amazon Bedrock vs Google Cloud Vertex AI: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Amazon Web Services signs a BAA for Amazon Bedrock on every plan we list. Google Cloud signs a BAA for Google Cloud Vertex AI on every plan we list.
- Business associate
- Amazon Web Services
- Tool
- Amazon Bedrock
- Plans with a BAA
- AWS accounts (standard AWS BAA)
- Checked
Signs a BAA
- Business associate
- Google Cloud
- Tool
- Google Cloud Vertex AI (Gemini Enterprise Agent Platform)
- Plans with a BAA
- Google Cloud customers (Agent Platform / Vertex AI, GA services)
- Checked
Signs a BAA
Side by side
| Amazon BedrockAmazon Web Services | Google Cloud Vertex AIGoogle Cloud | |
|---|---|---|
| BAA | Signs a BAA | Signs a BAA |
| Plans with a BAA | AWS accounts (standard AWS BAA) | Google Cloud customers (Agent Platform / Vertex AI, GA services) |
| How to get it | Accept or sign online | Accept or sign online |
| AI features outside the BAA partly covered excluded |
|
|
| Sources | 7 sources | 5 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Amazon Bedrock
- AWS accounts (standard AWS BAA)Review and accept the AWS BAA in AWS Artifact, for one account or across an organization. Process PHI only in HIPAA-eligible services. AWS notes its new sign-up experience isn't designed for regulated workloads and recommends an advanced/full account setup.Signs a BAA
Google Cloud Vertex AI
- Google Cloud customers (Agent Platform / Vertex AI, GA services)Accept the BAA on the IAM & Admin privacy page of any one project. You need an existing Services Agreement. The click-through BAA does not apply to purchases through an unaffiliated reseller or to offline agreement variants. Use only listed Covered Services with PHI.Signs a BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information. Keep PHI out of the AI features listed as outside the BAA.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.