Is Amazon SES HIPAA compliant? (2023 update)

Is Amazon SES HIPAA compliant? (2023 update) | Paubox

Last updated: 13 January 2023

We’ve been getting asked by customers and prospects about Amazon SES and their ability to use it in a HIPAA compliant manner.

We know the HIPAA industry is vast so we can empathize with just how many people need to use cloud-based services in this sector.

Today, we will revisit if Amazon SES can provide HIPAA compliant email or not.

SEE ALSO: HIPAA breaches and cloud providers

About Amazon SES

Amazon Simple Email Service (SES) is a cloud-based email sending service designed to help digital marketers and application developers send marketing, notification and transactional emails. It was originally designed by Amazon.com to serve its own customer base.

SEE ALSO: Is Amazon Web Services (AWS) HIPAA compliant?

Amazon SES and the business associate agreement

A business associate agreement (BAA) is a written contract between a covered entity and a business associate. It is required by law for HIPAA compliance.

As covered in a prior post, Amazon Web Services (AWS) does offer HIPAA compliant services.

It should be noted however, AWS does not offer HIPAA compliance for all of its cloud services.

For example, we found a an AWS whitepaper called Architecting for HIPAA Security and Compliance on Amazon Web Services.

Within that document, it states:


Customers who execute an AWS BAA may use any AWS service in an account designated as a HIPAA Account, but they may only process, store and transmit PHI using the HIPAA-eligible services defined in the AWS BAA. For a complete list of these services, see the HIPAA Eligible Services Reference page.


In July 2019, Amazon announced that Amazon SES joined the list of HIPPA eligible services.

Upon closer inspection however, there are concerns with using Amazon SES in a healthcare setting.

Using Amazon SES in a HIPAA compliant manner

Amazon published a whitepaper titled Architecting for HIPAA Security and Compliance on Amazon Web Service to help its healthcare customers use its products.

The platform offers various ways to satisfy encryption requirements for PHI. Amazon SES “supports both S/MIME and PGP protocols to encrypt messages for full end-to-end encryption, and all communication with Amazon SES is secured using SSL (TLS 1.2).”

However, this news isn’t as good as you might think.  We’ve covered the concerns over S/MIME and PGP protocols in other blog posts.  But that’s not actually the biggest problem.

SEE ALSO: PGP and S/MIME aren’t as secure as you think

By default, Amazon SES will attempt to make a secure connection to the receiving email server, but if a secure connection cannot be established, it will send the message unencrypted.

You can configure the system to require a secure connection, however.  But if you do, messages to your patients whose email addresses do not support encryption will not be delivered.

It’s referenced here in Data protection in Amazon Simple Email Service:

By default, Amazon SES uses opportunistic TLS. This means that Amazon SES always attempts to make a secure connection to the receiving mail server. If it can’t establish a secure connection, it sends the message unencrypted. You can change this behavior so that Amazon SES sends the message to the receiving email server only if it can establish a secure connection.


This is in contrast to Paubox Email API, which leverages patented technology to deliver messages to all email recipients in a HIPAA compliant manner, regardless if their email address is encrypted or not.

See also: U.S. Patent Office approves our approach to email encryption

Does Amazon SES offer HIPAA compliant email service?

Amazon SES is covered under the AWS BAA and healthcare providers can configure it to require email encryption before delivering an email.  However, this means a double digit percentage of emails will be quietly deleted by Amazon SES.

Conclusion

Amazon SES is covered by the AWS BAA, which is a good sign.

However, using Amazon SES either means:

  • A double digit percentage of emails will be sent unencrypted in transit, which is not a HIPAA best practice.
  • Or, those same double digit percentage of emails will quietly be deleted by Amazon SES, should you configure it with stricter security settings.

About the author

Hoala Greevy

Founder CEO Paubox. Kayak fishing when I can.

Read more by Hoala Greevy

Get started with
end-to-end protection

Bolster your organization's security with state-of-the-art email encryption and inbound email security.

Highest rated HIPAA compliant messaging solution on G2

EmailEncryption BestMeetsRequirements MeetsRequirements
SecureEmailGateway MostImplementable Total
SecureEmailGateway Leader Leader
SecureEmailGateway EasiestToUse EaseOfUse
SecureEmailGateway EasiestAdmin EaseOfAdmin
SecureEmailGateway BestUsability Total
SecureEmailGateway BestResults Total
SecureEmailGateway BestRelationship Total
EmailEncryption UsersMostLikelyToRecommend Nps
EmailEncryption MomentumLeader Leader
SecureEmailGateway BestSupport Mid Market QualityOfSupport
EmailEncryption BestMeetsRequirements MeetsRequirements
SecureEmailGateway MostImplementable Total
SecureEmailGateway Leader Leader
SecureEmailGateway EasiestToUse EaseOfUse
SecureEmailGateway EasiestAdmin EaseOfAdmin
SecureEmailGateway BestUsability Total
SecureEmailGateway BestResults Total
SecureEmailGateway BestRelationship Total
EmailEncryption UsersMostLikelyToRecommend Nps
EmailEncryption MomentumLeader Leader
SecureEmailGateway BestSupport Mid Market QualityOfSupport