Healthcare Cloud Costs: HIPAA Audit Controls and BAAs

Healthcare engineering teams make cost decisions inside two fixed boundaries. The HIPAA Security Rule tells them what they must be able to record about systems holding electronic protected health information (ePHI). Their cloud provider’s business associate agreement (BAA) tells them which services they may use for that data at all. Both narrow the options before anyone looks at a bill.

What HIPAA and the BAAs actually say

The technical safeguards live in 45 CFR 164.312. Two standards matter most for cloud operations:

• Access control, 164.312(a)(1): allow access to ePHI systems only to the people or software programs that have been granted access rights.
• Audit controls, 164.312(b): “implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.”

On the provider side, each hyperscaler limits PHI to a defined list:

• AWS keeps a HIPAA Eligible Services Reference (last updated 3 September 2026). Covered entities agree not to use those services for PHI without first signing the AWS BAA. The list includes EC2, EKS, S3, CloudTrail, SageMaker, and RDS for specific engines.
• Microsoft includes the HIPAA BAA in its Product Terms by default for covered entities and business associates, and scopes it to the services listed as in audit scope. Microsoft states plainly that having the BAA does not make a solution compliant.
• Google Cloud lists its covered products (Compute Engine, GKE, Cloud SQL and Cloud Storage among them) and tells customers to disable, or otherwise not use, products outside that list when working with PHI.

The cost effect: when a cheaper managed service is not on your provider’s covered list, it is not an option for PHI workloads, however attractive its price. Savings therefore have to come from how covered services are run: hours, size and storage tier.

Where ZopNight helps

ZopNight covers cost visibility, scheduling, recommendations and showback across AWS, GCP and Azure. In a HIPAA setting:

• Research and analytics compute on a clock. SageMaker notebook instances and HyperPod clusters can be scheduled to stop outside working hours, which suits data-science estates that sit idle overnight. See SageMaker notebook scheduling.
• An answer to “who stopped that system?” Every start and stop is recorded with what triggered it: a named schedule, an override, or a specific user. Mutating API calls are logged with request and response bodies, and the audit log exports to CSV for SOC 2 and ISO 27001 evidence. This records activity in the cost tool itself; your ePHI systems still need their own audit mechanisms under 164.312(b).
• Least-privilege operation. Team-scoped RBAC limits each team to its assigned resources, and read-only accounts get discovery and recommendations without any start, stop or remediation path.
• No automated changes to your databases. Remediation’s pause step explicitly excludes RDS, Aurora, Cloud SQL, ElastiCache, Azure SQL, PostgreSQL and MySQL resources.
• Policy before provisioning. IaC governance checks Terraform and OpenTofu plans in the pull request, with builtin rules tagged to frameworks including HIPAA, and never runs apply.

For how the change record is structured, see the audit trail. For keeping long-retention archives cheaper, see storage tiering.