GitHub Copilot vs Amazon Q Developer: which signs a HIPAA BAA?
Neither offers a BAA. GitHub doesn't offer a BAA for GitHub Copilot. Amazon Web Services doesn't offer a BAA for Amazon Q Developer.
- Business associate
- GitHub
- Tool
- GitHub Copilot
- Plans with a BAA
- None
- Checked
No BAA
- Business associate
- Amazon Web Services
- Tool
- Amazon Q Developer
- Plans with a BAA
- None
- Checked
No BAA
Side by side
| GitHub CopilotGitHub | Amazon Q DeveloperAmazon Web Services | |
|---|---|---|
| BAA | No BAA | No BAA |
| Plans with a BAA | None | None |
| How to get it | — | — |
| AI features outside the BAA | None listed | None listed |
| Sources | 5 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
GitHub Copilot
- Copilot Business / Copilot Enterprise (governed by the GitHub DPA)Section 12 of the GitHub DPA (October 2025) bars customers from giving GitHub HIPAA protected health information unless GitHub gives prior, written, specific consent. GitHub publishes no BAA or way to request one. Microsoft's HIPAA BAA in-scope service list does not include GitHub, so Microsoft's BAA does not cover Copilot.No BAA
- Copilot Free / Pro / Pro+ (individual accounts)The GitHub Terms of Service do not mention HIPAA, PHI or BAAs, and no BAA offering for individual plans was found. GitHub does not say whether the DPA's PHI restriction applies to these plans.Not confirmed
Amazon Q Developer
- Free / Pro tierThe AWS BAA (accepted in AWS Artifact) covers only listed HIPAA-eligible services. Amazon Q Developer is not listed, though Amazon Q Business is.No BAA
If you handle patient data
Don’t use either for protected health information unless the vendor signs a BAA with you in writing. See GitHub Copilot alternatives and Amazon Q Developer alternatives that do.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.