Q:

What is legally required to store HIPAA data in the "cloud"?

I was looking into storing SQL DB backups of a healthcare system in the cloud in the event of a disaster to be HIPAA compliant. The solution I came up with was to use Cloudberry backups. What I would want to do is export the SQL DB on my local computer, use a passphrase in the Cloudberry config and the highest encryption settings, and upload to S3 nightly. This data will be at rest.
From what I read in the past this seems acceptable, and the statement below makes it sound acceptable as well but I want to be sure. 
A PDF on the Cloudberry site states this:

Leveraging Amazon S3 as a HIPAA-compliant storage platform -
  The Amazon S3 platform offers a cost-efficient alternative to store your customers’ digital
  records. All incoming data is automatically duplicated across several distinct locations to provide
  high durability and availability of customer data. The implemented encryption algorithms protect
  the confidentiality of in-transit (inbound and outbound) and “at-rest” (resident) data as required
  by the HIPAA provision. The industry-grade authentication helps delegate specific access control
  permissions to different user and administrator accounts.

I've read about BAA (business associate agreements) and other things, which some people suggest, and some say is unneccessary. I figured it would just be best to ask the professionals - is this method of backing up HIPAA data to the cloud compliant?

A:

If you're using CloudBerry backup, enable the client-side encryption so that the files are encrypted before they reach Amazon S3.
Encrypted Data outside of HIPAA scope
You do not need a Business Associate Agreement (BAA) if you are sending encrypted data to a third party provider.  Note this encryption must be done with FIPS 140-2 compliant ciphers such as AES-128.  Essentially, under HIPAA, encrypted PHI data does not fall under the scope of the law's protection, so long as it is done with approved ciphers.  If only encrypted data is compromised, you do not need to notify anyone of the breach.
If unencrypted, get a BAA
Amazon does now offer HIPAA-compliant hosting packages, so if you want to have data unencrypted at Amazon, you would need to sign off on their BAA (provided boilerplate via  a web form).  I strongly disagree that a BAA is unnecessary for a cloud provider you are storing PHI data with -- I've been through many HIPAA audits from third-party certification companies and they always ask about this.    You would then also need your own documentation and security policy to reflect this relationship and document safeguards around the PHI.
Source Material
HHS provides information about encryption and breach notification here
Information about BAAs is provided by HHS here.

