Kiro and HIPAA Compliance — What It Changes for Healthcare Developers in France

Developers in the healthcare sector navigate a complex regulatory environment. In France, the trio GDPR + HDS + HIPAA governs the processing of health data depending on whether the application targets the French, European or American market. The General Data Protection Regulation (GDPR) covers personal data in Europe, the Health Data Hosting (Hébergeur de Données de Santé, HDS) certification applies to hosting in France, and the American HIPAA framework governs patient data in the United States.

Until recently, using an artificial intelligence (AI) assisted development tool with patient data posed a major compliance problem. Kiro crossed a milestone on May 26, 2026: it now appears in the list of HIPAA-eligible AWS services — with an important exclusion that we detail below.

What is HIPAA?

The American regulatory framework

HIPAA (Health Insurance Portability and Accountability Act) is the American federal law that governs the protection of electronic Protected Health Information (ePHI). This includes:

• Patient names associated with medical data
• Social security numbers, medical identifiers
• Diagnoses, treatments, prescriptions
• Biometric data, laboratory results
• Any information that can identify a patient in a medical context

The key obligations

For developers, HIPAA imposes:

• Encryption at rest and in transit: all ePHI data must be encrypted
• Access controls: strong authentication, principle of least privilege
• Audit logging: traceability of who accesses what and when
• Business Associate Agreement (BAA): formal contract with any subcontractor handling ePHI
• Incident response: notification procedures in case of a data breach

HIPAA, GDPR and HDS: the French trio

Positioning of the regulations

For a French e-health startup, the regulations overlap:

When HIPAA applies

HIPAA applies as soon as your application:

• Processes American patient data
• Is used by American healthcare professionals (the "covered entities" within the meaning of the law)
• Stores or transmits ePHI on behalf of an American entity

In concrete terms, if your French startup develops a telemedicine application targeting the American market, or a Software as a Service (SaaS) practice management software for American doctors, HIPAA applies.

Kiro HIPAA eligible: what it means exactly

The announcement, and its restriction

Since May 26, 2026, Kiro has been included in the AWS HIPAA Eligible Services Reference. The official release note specifies the scope: eligibility concerns the integrated development environment (IDE) and the command-line interface (CLI). Kiro Web is not covered.

This restriction is stated in black and white in the AWS reference, where the entry is labeled "Kiro [excluding Kiro Web]". This is the detail that matters most in practice: if your teams work from the browser, that usage falls outside the eligible scope. So check which Kiro surface your developers use before considering your development chain to be covered.

What is HIPAA eligibility at AWS?

Being listed as a HIPAA-eligible service means that the service:

1. Can be covered by a BAA signed with AWS
2. Is deemed suitable for processing ePHI by AWS compliance teams
3. Can be used for workloads involving ePHI, subject to correct configuration

It is a necessary but not sufficient condition. AWS states it clearly: customers remain responsible for their own HIPAA compliance, and using eligible services with ePHI requires having signed a BAA with AWS beforehand.

The BAA with AWS

The Business Associate Agreement formalizes AWS's responsibilities as a health data subcontractor. To include Kiro in your HIPAA scope:

1. Sign (or update) the AWS BAA via AWS Artifact
2. Verify that Kiro appears in the list of covered services, taking into account the Kiro Web exclusion
3. Configure your account according to the security recommendations

Data retention and model training

This is the point to examine closely, as it depends on your subscription. According to Kiro's documentation:

• On the paid Pro, Pro+, Pro Max and Power subscriptions, your content is not used to train foundation models.
• For enterprise usage, prompts and responses may be stored in the region where the profile is configured, in order to ensure the operation of the service (prompt logging, activity reporting), without being used for service improvement.

In other words, "no retention" would be inaccurate: there is regional storage for the operation of the service. For details on encryption, logging and access control, refer to Kiro's Privacy and Security documentation, which describes the application of the AWS shared responsibility model.

Concrete impact for healthcare developers

What eligibility makes it possible to consider

Subject to a signed BAA and a compliant configuration, you can consider:

• Developing with patient context: sharing database schemas containing ePHI columns
• Debugging with real data: using logs containing patient identifiers as context
• Generating migrations: creating schema migrations for tables containing ePHI
• Writing validations: generating validation rules specific to medical formats
• Auditing code: having the agent review ePHI-processing code

The minimization principle still applies: the fact that a service is eligible does not justify exposing more data than necessary.

Practical example: a FHIR resource

The Fast Healthcare Interoperability Resources (FHIR) standard structures the exchange of health data.

// Example of a FHIR R4 resource typed in TypeScript.
// Annotated fields contain ePHI and therefore fall within the HIPAA scope.

interface PatientResource {
  resourceType: 'Patient';
  id: string;
  identifier: Array<{
    system: string;    // e.g. "http://hospital.org/mrn"
    value: string;     // Medical Record Number (ePHI)
  }>;
  name: Array<{
    family: string;    // Last name (ePHI)
    given: string[];   // First name (ePHI)
  }>;
  birthDate: string;   // Date of birth (ePHI)
}

Steering for healthcare standards

Create a steering file dedicated to the conventions of your healthcare application:

# .kiro/steering/healthcare-standards.md

## Healthcare development standards

### Sensitive data
- Always encrypt ePHI fields before storage
- Never log patient identifiers in clear text — use masking
- Implement soft delete for patient data (retention obligation)

### Medical standards
- Use FHIR R4 profiles for patient resources
- Validate codes from the International Classification of Diseases 10th revision
  (ICD-10) and SNOMED CT (Systematized Nomenclature of Medicine Clinical Terms)
- Comply with the Health Level 7 version 2 (HL7v2) format for hospital interfaces

### Audit
- Every access to a patient resource must be logged
- Audit format: {timestamp, userId, action, resourceType, resourceId}
- Define the log retention period with your compliance officer

### Testing
- Tests using patient data must use a synthetic dataset
- Never commit real ePHI data in fixtures

What HIPAA eligibility does NOT mean

1. It is not a certification of your application: Kiro can fit into a compliant scope, your application must be compliant on its own
2. It is not an audit: eligibility does not replace a HIPAA audit of your organization
3. It is not automatic: without a signed BAA, use with ePHI is not authorized
4. It is not universal: Kiro Web is explicitly excluded

Shared responsibility

AWS applies the shared responsibility model:

• AWS is responsible for: the security of the infrastructure and the managed service
• You are responsible for: access configuration, the choice of exposed data, security policies, user training

Comparison with other AI development tools

This table reflects the state of the public sources consulted in August 2026. These positions change quickly: check with each vendor before any decision.

Two misconceptions to correct. First, Kiro is not the only development assistant that can be mobilized within a HIPAA framework: Cursor and Claude Code both offer a BAA, with restrictive conditions.

The value of Kiro for a team already on AWS is therefore not being alone in the niche, but integrating with the existing AWS BAA rather than adding an extra vendor contract.

Implications for e-health startups on AWS

Reference architecture

┌─────────────────────────────────────────────┐
│       AWS account dedicated to health         │
│                   workloads                    │
│                                              │
│  ┌──────────┐    ┌──────────┐    ┌────────┐ │
│  │  Kiro    │    │  RDS     │    │  S3    │ │
│  │ IDE/CLI  │    │  (ePHI)  │    │ (docs) │ │
│  └──────────┘    └──────────┘    └────────┘ │
│                                              │
│  ┌──────────────────────────────────────┐   │
│  │        AWS CloudTrail (audit)         │   │
│  └──────────────────────────────────────┘   │
└─────────────────────────────────────────────┘

The storage services mentioned are themselves HIPAA eligible: Amazon Relational Database Service (RDS) for the engines listed by AWS, and Amazon Simple Storage Service (S3).

Compliance checklist

• BAA signed with AWS via AWS Artifact
• Usage restricted to the covered Kiro surfaces (IDE and CLI, not Kiro Web)
• AWS Identity and Access Management (IAM) configured with multi-factor authentication (MFA)
• AWS CloudTrail enabled on the relevant services
• Default encryption on S3, RDS and Amazon Elastic Block Store (EBS)
• Dedicated Amazon Virtual Private Cloud (VPC) with private endpoints
• Audit log retention policy validated with your compliance officer
• HIPAA training for all developers
• Healthcare security steering files in the project
• Data breach notification procedure documented

Conclusion

Kiro's HIPAA eligibility is good news for healthcare developers in France who target the American market: the tool can fit into a compliant scope without an additional vendor contract, since it relies on the AWS BAA.

Two caveats are worth keeping in mind. The first is scope: Kiro Web is excluded, which must translate into an explicit instruction for your teams. The second is that the eligibility of a tool says nothing about the compliance of your application. HIPAA compliance remains a continuous effort — training, rigorous configuration, regular audits.

For French startups that already combine GDPR and HDS, adding HIPAA to the equation remains a challenge. But the tool ecosystem has grown considerably, and the choice is no longer limited to giving up AI assistance.