Conditional Bubble offers a BAA only as a HIPAA add-on to the Dedicated Enterprise plan, so Free, Starter, Growth, Team and shared Enterprise have no BAA (checked 2026-10-28). A clinic intake portal or patient scheduling app built on any of those plans should not hold PHI.
Short answer
A BAA is available on Dedicated Enterprise as a HIPAA add-on. It covers app hosting on a dedicated AWS environment in the US. Pricing is handled through Bubble's sales team and is not published.
Plugins and APIs that receive PHI need their own BAA. Bubble's docs state that the broader platform and its internal processes do not currently meet HIPAA standards, so the BAA scope is the dedicated environment only. For the terms, see the HIPAA glossary (BAA, PHI).
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not published by the vendor | Not published by the vendor |
| Starter | No | Not published by the vendor | Not published by the vendor |
| Growth | No | Not published by the vendor | Not published by the vendor |
| Team | No | Not published by the vendor | Not published by the vendor |
| Enterprise (shared infrastructure) | No | Not published by the vendor | Not published by the vendor |
| Dedicated Enterprise (HIPAA add-on) | Yes | Through sales. Bubble signs the BAA and provisions a dedicated HIPAA environment. | Add-on; price not published by the vendor |
What the BAA covers and what it excludes
Covered
- Bubble app hosting on the dedicated HIPAA environment (AWS, US).
Not covered
- Free, Starter, Growth and Team plans.
- Enterprise on shared infrastructure.
- Third-party plugins and API vendors that receive PHI.
- AI Agent data access, which is kept off in HIPAA environments.
In practice, Bubble's BAA covers Bubble. Any third-party service in the app that touches PHI needs its own signed BAA. For example, if a patient-intake app sends form data to an email or automation service, that service needs a BAA with you. Bubble's BAA does not extend to it.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | US (dedicated HIPAA environment); region selectable on Enterprise Dedicated |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Data residency: US on the dedicated HIPAA environment. The region is selectable on Enterprise Dedicated.
Bubble does not describe the encryption as end-to-end. Plan-by-plan control detail beyond the table above is not published by the vendor.
How to use Bubble with PHI
- Sign the BAA before any PHI enters the app. Test data with real patient names does not count as a safe exception.
- Build and host the app only in the dedicated HIPAA environment, never on a plan without a BAA.
- Sign a BAA with every plugin and API vendor that receives PHI. This includes automation tools such as Zapier; see Is Zapier HIPAA compliant? for how one such service treats this.
- Configure access controls, SSO and audit logging so that front-desk, billing and clinical roles see only what they need.
- Keep AI Agent data access off.
- Train staff and set written policies for what may be entered into the app.
A signed BAA does not make an app compliant by itself. Compliance depends on the signed BAA, your configuration and your policies, not on the platform alone.
Alternatives with a BAA
If you need a website or booking front end rather than a custom app, these vendors have BAA paths. Each verdict is conditional:
- Is GoDaddy HIPAA compliant?: conditional. The BAA comes from Microsoft 365 email plans that GoDaddy represents as HIPAA-compliant.
- Is Squarespace HIPAA compliant?: conditional. The BAA path is Acuity Scheduling Premium or Powerhouse.
- Is Wix HIPAA compliant?: conditional. The BAA path is the Business plan.
See the full category at HIPAA-compliant website builders, or browse every vendor check at Is it HIPAA compliant? All vendors.
Sources
- HIPAA | Bubble Support Center — Help article, checked 2026-10-28. "HIPAA and BAA support is available as an add-on to Bubble's Dedicated Enterprise plan. With it, Bubble signs a BAA with you and runs your app on dedicated, HIPAA-ready infrastructure. Bubble's BAA covers Bubble, and any third-party service that receives PHI from your app needs its own signed BAA with you."
- HIPAA-Compliant Healthcare App Builder | Bubble — Vendor page, checked 2026-10-28. "With HIPAA support on Dedicated Enterprise, Bubble signs a BAA and runs your app on dedicated, HIPAA-ready infrastructure."
- HIPAA-Compliant Healthcare App Builder | Bubble — Vendor page, checked 2026-10-28. "We provision a dedicated HIPAA environment on AWS in the US."
- HIPAA-Compliant Healthcare App Builder | Bubble — Pricing page, checked 2026-10-28. "Pricing is scoped to your use case; talk to sales to get started."
- AI App Security Features: SOC 2, GDPR & More | Bubble — Trust center, checked 2026-10-28. "Your data is safeguarded in transit with TLS and at rest with AES-256 encryption through RDS."
- AI App Security Features: SOC 2, GDPR & More | Bubble — Trust center, checked 2026-10-28. "Bubble complies with the SOC 2 Type II standard for security and offers a GDPR-compliant data processing agreement (DPA)."
- HIPAA – Bubble Docs — Help article, checked 2026-10-28. "While some sub-processors might be HIPAA compliant, the entire Bubble platform and its internal company processes currently do not meet these standards. Consequently, apps built on Bubble won't achieve HIPAA compliance."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. Later changes to vendor status appear on /changes/.
FAQ
Does Bubble sign a BAA?
Yes, but only as a HIPAA add-on to the Dedicated Enterprise plan. It is obtained through sales. Bubble signs the BAA and provisions a dedicated HIPAA environment.
Can I use Bubble's Free, Starter, Growth or Team plan for PHI?
No. None of these plans includes a BAA, and neither does Enterprise on shared infrastructure. Do not put PHI in apps on those plans.
What does Bubble's BAA cover and what does it not cover?
It covers Bubble app hosting on the dedicated HIPAA environment (AWS, US). It does not cover other plans, shared Enterprise infrastructure, third-party plugins and API vendors that receive PHI, or AI Agent data access, which is kept off in HIPAA environments.
Do third-party plugins and APIs in a Bubble app need their own BAA?
Yes. Bubble's BAA covers Bubble, and any third-party service that receives PHI needs its own signed BAA with you.