jameskilton is correct. AWS and Firehost give you a "HIPAA Compliant-Ready" environment (Firehost's own marketing line). It's ready for you to implement your own encryption cluster, key management and rotation system, network security, software security, etc.