Government and public statistics

Guidance on HIPAA & Cloud Computing

U.S. Department of Health and Human Services, Office for Civil Rights, n.d.

Read on October 16, 2026

What it is: The U.S. health department's question-and-answer guidance on when a cloud service provider counts as a HIPAA business associate, and what contract it needs. It answers the question of whether a provider holding only encrypted health data is covered.
How much weight it carries: Official HHS Office for Civil Rights guidance, read from a 2024 archived copy because hhs.gov blocked automated access on 2026-10-16. It explains how regulators read the HIPAA Rules and is not itself a regulation; the undated copy has no visible publication date.

Facts taken from this source

HHS says the covered entity and a cloud service provider that holds its health information must sign a HIPAA-compliant business associate agreement.
“the covered entity (or business associate) and the CSP must enter into a HIPAA-compliant business associate agreement (BAA)” (Question 2: If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?)
HHS says that lacking an encryption key does not exempt a cloud service provider from business associate status under HIPAA.
“Lacking an encryption key does not exempt a CSP from business associate status and obligations under the HIPAA Rules.” (Question 2: If a CSP stores only encrypted ePHI and does not have a decryption key, is it a HIPAA business associate?)