Can PHI be used with Amazon Q?

PHI use with Amazon Q is possible with appropriate controls. BAA execution and data handling review are required.

What controls should be implemented when using Amazon Q?

Organizations should implement role-based access controls, maintain audit logs, execute a BAA (if applicable), review data retention policies, and document the data flow for any PHI processed through Amazon Q. Specific controls depend on the deployment configuration.

Who should approve Amazon Q for use in a healthcare organization?

Approval for Amazon Q should involve legal, compliance, security, and IT leadership. A formal vendor review process is recommended.

How often should Amazon Q be reviewed?

Based on the current VNDRIQ classification, Amazon Q should be reviewed on a quarterly basis. Reviews should include BAA status verification, data handling policy changes, and any new AI feature introductions.

What is the AI training risk for Amazon Q?

Amazon Q carries a moderate AI training risk. Review the vendor's data processing agreement for model training clauses.

ActiveRestricted / Review Required

Amazon Q

AI Assistants

Last verified 2026-09-30

Vendor Site

Approval Status

Under Review

Last reviewed: 2026-09-30

Visit Vendor Website

External link · Not an endorsement

Key Considerations

Data Retention: Review required

View Approval Library

Executive Summary

Amazon Q is a software platform.

Typical Use Cases

Enterprise software operations
Data management and reporting
Workflow automation

Who Uses This

Healthcare IT and operations teams.

Compliance Considerations

Review current BAA status and data handling policies before deployment.

Primary Benefits

Operational efficiency gainsWorkflow automation and integrationCentralized data managementRequires verification and approval workflow before deployment.

BAA and Compliance

BAA Status

PHI Exposure Risk

HIPAA Risk Level

Approval Tier

Restricted / Review Required

Review Frequency

—

Last Verified

2026-09-30

Required Administrative Controls

Designate a vendor owner for ongoing governance
Document the vendor in your organizational vendor register
Schedule periodic reviews per the VNDRIQ review frequency

Required Technical Controls

Enable audit logging for all PHI access
Implement role-based access controls
Enforce MFA for administrative access

Required Staff Training

Train staff on approved use cases and restrictions
Document data handling procedures for this vendor
Complete annual HIPAA awareness refresher

Required Policies

Create or update vendor-specific data handling policy
Include vendor in Business Associate Agreement log
Document escalation path for compliance incidents

AI Governance Review

AI Training Risk

Data Retention Considerations

Review vendor data retention policies. Confirm data is not retained beyond stated processing purposes.

Model Governance

Evaluate whether Amazon Q uses generative or predictive AI features that process PHI. Request documentation of model governance practices.

Human Oversight Requirements

Clinical AI outputs from Amazon Q should be reviewed by qualified clinical staff. AI-assisted decisions should not replace clinical judgment.

Vendor Management Requirements

Assign an internal vendor owner. Establish a review cadence of quarterly. Track vendor communications for policy or terms changes.

Monitoring Requirements

Monitor vendor security bulletins, data breach notifications, and terms-of-service changes. Re-evaluate risk classification after any material change.

Governance Overview

Enterprise governance assessment based on verified evidence across five dimensions. Overall governance score: 66/100.

Evidence Confidence

Not Verified

Security & Compliance

Certifications, attestations, and security posture.

BAA Available

Not Verified

BAA Verified

Not Verified

HIPAA Claimed

Yes, Amazon Q Business is HIPAA eligible.

SOC 2 Status

Yes, Amazon Q Business is SOC 1, 2, and 3 compliant.

SOC 2 Type Details

Not Verified

HITRUST Status

Not explicitly stated for Amazon Q specifically; AWS maintains broad HITRUST certifications for its infrastructure.

ISO 27001 Status

AWS maintains ISO 27001 certification for its infrastructure.

GDPR Claimed

Not Verified

PIPEDA Claimed

Not Verified

Penetration Testing

Not Verified

Trust Center

Not Verified

Vulnerability Disclosure Program

Not Verified

Breach History

Not Verified

Cyber Insurance

Not Verified

Security Contact

Not Verified

AI Architecture

AI System Type

Not Verified

Foundation Model Provider

AWS (proprietary models including Amazon Titan and others available via Amazon Bedrock).

Proprietary Models

Not Verified

Third-Party Models

Not Verified

Multi-Model Architecture

Not Verified

Multi-Agent Architecture

Not Verified

Agent Count (Claimed)

Not Verified

RAG Enabled

Not Verified

Customer-Specific Training

Not Verified

Human Oversight

Not Verified

Data Flow

Input

Processing

RAG

Model

Output

Clinical Influence

Degree of clinical decision involvement and regulatory status.

NoneDocumentationAdvisoryDecision SupportAutonomous Action

None

No clinical influence — administrative or operational use only.

Documentation Generation

Not Verified

Diagnostic Assistance

Not Verified

Treatment Recommendation

Not Verified

Coding Generation

Not Verified

Clinical Decision Support

Not Verified

Patient-Facing Output

Not Verified

Clinician Review Required

Not Verified

FDA Status

Not Verified

Enterprise Controls

SSO, SCIM, RBAC, audit logging, and administrative tooling.

SSO

Not Verified

SAML

Not Verified

SCIM

Not Verified

RBAC

Not Verified

MFA

Not Verified

Audit Logs

Not Verified

Audit Export

Not Verified

SIEM Support

Not Verified

Admin Console

Not Verified

Retention Controls

Not Verified

Business Unit Separation

Not Verified

Sandbox Environment

Not Verified

Integration Matrix

Electronic Health Record systems

No EHR integrations verified yet.

Integration data will appear here when verified.

Evidence Explorer

Verification status and confidence for every governance claim.

Confidence:Not Verified

Verification Methods

Vendor Attested

Not Verified

Independently Verified

Not Verified

Contractually Verified

Not Verified

Customer Verified

Not Verified

Confidence Framework

Independent confidence metrics — each scored 0-100 based on evidence and verification status.

Confidence metrics not yet calculated.

Scores will populate as evidence and documentation are verified.

Evidence Center

Document tracking with verification status for each evidence type.

Verified

Received

Requested

Missing

Expired

Whitepaper

Missing

Security Documentation

Missing

BAA

Missing

HIPAA Documentation

Missing

SOC Report

Missing

HITRUST

Missing

FDA Documentation

Missing

Clinical Study

Missing

Case Study

Missing

Customer Reference

Missing

Release Notes

Missing

Pricing

Missing

Product Documentation

Missing

Vendor Timeline

Chronological log of registry events, evidence updates, and compliance reviews.

Compliance and risk assessment completed
Source: vndriq-review
Sep 30, 2026
Vendor added to VNDRIQ registry
Source: system
Aug 17, 2026

Recommended Use

Recommended For

See approval tier for guidance.

Use With Restrictions

No restrictions flagged.

Not Recommended For

No hard exclusions identified.

Approval Workflow Checklist

Legal Review

Review data processing agreements and BAA terms.

Required

Security Review

Assess encryption, access controls, and audit logging.

Required

Compliance Review

Validate HIPAA applicability and PHI data flow.

Required

BAA Review

Verify BAA availability and execute before PHI use.

Required

AI Governance Review

Confirm model training opt-out and data retention policies.

Optional

Executive Approval

Required for restricted or not-recommended vendors.

Required

Common Questions

BAA status for Amazon Q is listed as null. Verify directly with the vendor.

Vendor Intelligence Hub

Explore Amazon Q in Context

Approved Alternatives

Arini

Approved With Restrictions

CephX

Approved

Governance Resources

Frameworks & Standards

Healthcare AI Governance Framework

AI Governance for DSOs

AI Vendor Risk Management

Healthcare AI Resources

Benchmark Reports

Standards Alignment

ISO 42001 NIST AI RMF

Comparison Guides

Side-by-Side Vendor Comparisons

All Comparisons

OpenAI vs Anthropic

Freed vs DeepScribe

S10.AI vs Freed

Archy vs Dentrix

Pearl vs Overjet

Request Vendor Evaluation

Get a structured risk assessment and governance recommendation for Amazon Q.

Step 5 of 7 — Continue Evaluation

Review Compliance

Assess BAA availability, HIPAA posture, and PHI exposure risk.

Risk classifications are based on available public information and internal review at time of last verification. Verify directly with each vendor before deployment. This is not legal or compliance advice.