No, and we would rather tell you plainly than imply otherwise.
AWS holds SOC 2 and HITRUST at the infrastructure layer, and their audit reports are available to you directly through AWS Artifact. What we provide on top of that is evidence that the controls in your environment exist and work — encryption at rest and in transit, access control, audit logging, monitoring, tested backups, and a signed BAA.
For most healthcare diligence, that evidence is what is actually being asked for. If SOC 2 is a hard contractual requirement from a payer or a state contract rather than general diligence, tell us early — we will say so rather than waste your time.
One thing worth knowing: there is no such thing as a HIPAA certificate. HHS does not certify anyone. Any hosting company telling you they are "HIPAA certified" is describing something that does not exist.
