Does Amazon Connect sign a BAA?
Yes, it signs a BAA
Amazon Connect is on AWS's HIPAA Eligible Services list, which falls under the AWS BAA that customers accept in AWS Artifact. AWS documentation calls Amazon Q in Connect HIPAA eligible.
- Business associate
- Amazon Web Services
- Tool
- Amazon Connect
- Plans with a BAA
- Any AWS account that accepts the AWS BAA
- Checked
Signs a BAA
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Any AWS account that accepts the AWS BAA | Signs a BAA | Accept or sign onlineAWS Artifact (AWS console) | The AWS BAA is accepted in AWS Artifact for one account or for all accounts in an AWS Organization. Amazon Connect is HIPAA eligible, and AWS says generally available features of listed services are eligible unless specifically excluded. Amazon Connect Health is listed separately and also needs AWS's Healthcare and Life Sciences Addendum.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Amazon Web Services says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Amazon Q in Connect (generative AI agent assistance) | Covered | The Amazon Connect admin guide says Amazon Q in Connect is HIPAA eligible. It runs on Amazon Bedrock, which is also on the eligible list.[4],[2] |
| Contact Lens (conversational analytics) | Covered | Contact Lens is not named on the eligible list. It falls under AWS's rule that generally available features of listed services (Amazon Connect) are eligible unless specifically excluded, and no exclusion is listed. Amazon Q in Connect requires Contact Lens conversational analytics for calls.[1],[4] |
| Amazon Lex bots (self-service voice/chat) | Covered | Amazon Lex, Amazon Polly and AWS Transcribe each appear on the HIPAA eligible list.[2] |
Sources
- HIPAA Eligible Services Reference
- AWS Services in Scope by Compliance Program: HIPAA BAA
- Activate the AWS BAA in AWS Artifact
- Use Amazon Q in Connect for generative AI–powered agent assistance in real-time
- Best practices for HIPAA compliance in Amazon Connect
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.