Azure OpenAI vs Amazon Bedrock: which signs a HIPAA BAA?
Only Amazon Bedrock offers a BAA. We couldn't confirm a BAA for Azure OpenAI from Microsoft's own pages. Amazon Web Services signs a BAA for Amazon Bedrock on every plan we list.
- Business associate
- Microsoft
- Tool
- Azure OpenAI / Microsoft Foundry (Azure AI Foundry)
- Plans with a BAA
- Not stated
- Checked
Not confirmed
- Business associate
- Amazon Web Services
- Tool
- Amazon Bedrock
- Plans with a BAA
- AWS accounts (standard AWS BAA)
- Checked
Signs a BAA
Side by side
| Azure OpenAIMicrosoft | Amazon BedrockAmazon Web Services | |
|---|---|---|
| BAA | Not confirmed | Signs a BAA |
| Plans with a BAA | Not stated | AWS accounts (standard AWS BAA) |
| How to get it | — | Accept or sign online |
| AI features outside the BAA partly covered excluded | None listed |
|
| Sources | 8 sources | 7 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Azure OpenAI
- Azure subscription (EA / MCA / CSP), Models sold by Azure incl. Azure OpenAIThe Microsoft BAA comes by default through the Product Terms and DPA, with no separate signature, but only for in-scope Azure services. Whether Azure OpenAI / Foundry Models sold by Azure are in scope could not be confirmed from an official page. Microsoft Q&A moderators (not official documentation) give conflicting answers.Not confirmed
- Foundry Models from partners and community (serverless / Marketplace)Microsoft treats these as Non-Microsoft Products governed by each provider's terms and billed through Azure Marketplace. No official HIPAA statement for them was found.Not confirmed
Amazon Bedrock
- AWS accounts (standard AWS BAA)Review and accept the AWS BAA in AWS Artifact, for one account or across an organization. Process PHI only in HIPAA-eligible services. AWS notes its new sign-up experience isn't designed for regulated workloads and recommends an advanced/full account setup.Signs a BAA
If you handle patient data
Use Amazon Bedrock on a plan listed above, and sign the BAA before anyone enters protected health information. Don't put PHI into Azure OpenAI unless Microsoft gives you a BAA in writing. Other Azure OpenAI alternatives that sign a BAA
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.