On April 23, 2026, HHS OCR announced four separate settlements, each opened after a ransomware attack. The common thread was not the malware. According to a Sidley Austin analysis, OCR found that every one of those organizations lacked a compliant risk analysis.
Read that again as a CEO. The penalty landed on the missing process, not on the attacker. And the process is exactly what you are about to outsource.
If you are shortlisting an AWS partner for healthcare companies like yours, you are not buying engineers. You are buying who answers for the next audit, the next incident, and the next OCR letter. Pick on that basis.
The Breach Math Your Board Will Ask About
IBM’s 2025 Cost of a Data Breach report put the average healthcare breach at $7.42 million, the highest of any industry for the 15th year running. Healthcare also took the longest to identify and contain a breach: 279 days, more than five weeks slower than the global average of 241 days (HIPAA Journal summary of the IBM report).
Those 279 days are not a tooling problem. They are a monitoring ownership problem. Somebody has to watch GuardDuty findings, CloudTrail anomalies, and Security Hub alerts on a Saturday night. If your partner’s answer is “we configure it and hand you the dashboard,” you just hired yourself as the on call engineer.
Four Kinds of Partner, and Where Each One Breaks
Most healthcare leaders compare partners on hourly rate and logo slides. Compare them on failure mode instead.
| Partner type | What they are good at | Where they fail you |
|---|---|---|
| Generalist AWS reseller | Billing, credits, basic migrations | No HIPAA architecture depth. They resell the account and leave you the risk analysis. |
| Large systems integrator | Enterprise programs, big headcount | Junior staff on your account, long ramp, pricing built for hospital systems rather than a 60 person health company |
| Compliance software vendor | Evidence collection, auditor workflows | Tools do not fix a public S3 bucket or a flat VPC. They report it. |
| Specialist AWS partner for healthcare companies | Architecture, remediation, and operations under one owner | Smaller bench than a global SI, which is why you need to ask who exactly staffs you |
The right pick is the last row, with proof. A healthcare cloud security partner has to build the controls, run them, and show you the evidence. Anything less leaves a gap that OCR will find first.
What the AWS Healthcare Competency Does and Does Not Tell You
AWS runs a Healthcare Competency program that validates partners through technical and business review. AWS says on its Partner Network blog that competency requirements are designed to tighten over time as verticals mature.
Use it as a filter, not a verdict. A competency badge reviews the company. It does not tell you which engineer opens your Terraform repo on Monday. Counterintuitively, a smaller partner whose named engineers have shipped HIPAA workloads often beats a badge holder that rotates new hires through your account.
The Regulatory Clock Is Not Your Excuse
The proposed HIPAA Security Rule overhaul was published in the Federal Register on January 6, 2025. As of mid 2026 it is still not final. HHS now targets final action no earlier than July 2027, per the Clearwater update and Medcurity’s tracking of the Unified Agenda.
Some CEOs read that as breathing room. It is the opposite. Enforcement did not pause. OCR has expanded its Risk Analysis Initiative to cover risk management, meaning what you actually did about the risks you found. Clearwater reports risk analysis, risk management, and business associate agreement management remain the most frequent deficiencies OCR finds.
So your partner needs to deliver today’s required controls: a documented risk analysis, encryption on everything that stores or moves PHI, MFA, audit logging, and tracked remediation with owners and dates. The proposed rule would make several of these mandatory in writing. A good partner builds to that standard now so you do not rebuild in 2027.
Seven Questions That Separate Partners From Resellers
Ask these in the first call. Weak partners get vague by question three.
| Question | Answer you want | Red flag |
|---|---|---|
| Will you sign a BAA with us? | Yes, before anyone touches the environment | “AWS already has a BAA” |
| Who owns the AWS accounts and root credentials? | Your company, in your AWS Organization | The partner holds the management account |
| Who staffs us, by name? | Named AWS Certified engineers | “Our team” |
| How do you produce the risk analysis? | Mapped to real AWS evidence: Config, Security Hub, CloudTrail | A questionnaire and a PDF |
| Who watches findings after go live? | A defined owner with response times | “You will get alerts” |
| What happens at contract end? | Documented handover, everything in your accounts | Proprietary tooling you cannot keep |
| Can we talk to a healthtech client? | Yes | “Under NDA” for every reference |
The BAA row trips up more teams than any other. The AWS BAA covers AWS’s side of the relationship. The moment a partner’s engineers can reach an environment holding PHI, that partner is a business associate and needs its own BAA with you.
Three Mistakes That Show Up After Signing
Buying a dashboard instead of an outcome. A compliance platform shows red and green. It does not remediate. Teams buy one, see 40 failing controls, and have nobody assigned to fix them.
Letting the partner own your accounts. It feels convenient until you want to leave. Keep the management account, billing, and root access in your hands from day one.
Scoping the project as one time. HIPAA is continuous. Auditors and OCR ask for ongoing evidence, not a snapshot from the month you launched. If the proposal ends at go live, you are buying half a program.
Why Healthtech CEOs Choose Aland Cloud
We are an AWS Partner, and the engineers on your account hold AWS certifications. We have spent years getting healthtech companies through HIPAA on AWS, so we have seen where the 279 day detection gaps actually come from. We do not hand you a dashboard and wish you luck.
Here is what AWS managed services for healthtech looks like when we run it:
- Architecture built for PHI. Multi account structure, encryption everywhere, private networking, and logging that survives an audit.
- A risk analysis tied to live AWS evidence, with every finding assigned an owner and a date, which is what OCR now expects.
- Operations after go live. We watch the findings so your team builds product instead of chasing alerts.
- Your accounts, your data, your exit. Everything lives in your AWS Organization. If you leave us, you leave with all of it.
You are comparing vendors, so compare us on the seven questions above. We want that test. Book a free consultation at Alandcloud, bring your current AWS setup, and we will tell you straight where your gaps are, whether you hire us or not.
The partner you choose will be the first name OCR asks about. Make it one you would put in front of them.