GitHub does not publish a BAA for any plan on the pages checked, so there is no published basis for putting PHI in repositories, issues or GitHub Copilot prompts.
Unknown No BAA is published for any GitHub plan on the pages checked, so no covered services or plan can be named. Last verified 2026-10-28.
This directory is published by Chanty, Inc. GitHub has no relation to Chanty.
Short answer
GitHub's Terms of Service, Customer Agreements, Privacy Statement and Trust Center contain no BAA or HIPAA terms. No public statement was found either way for GitHub plans or for GitHub Copilot. "Unknown" is not "no": it means the vendor has published nothing to cite.
Wording rule for this site: GitHub is not described as "HIPAA compliant" or "HIPAA certified." Until GitHub publishes a BAA, treat PHI as out of scope for it. For definitions of BAA and PHI, see the HIPAA glossary. For other tools, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All plans (and GitHub Copilot) | Not published by the vendor | Not published by the vendor | Not published by the vendor |
No plan is listed as included or excluded. The table has one row because the vendor's pages name no plan-level BAA terms.
What the BAA covers and what it excludes
Covered services
- None published.
Excluded features
- None published.
Without a published BAA, nothing can be listed as covered. Repositories, issues, pull requests, Actions, Codespaces and Copilot therefore have no published coverage.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" refers to the pages checked for this entry. It is not a statement that the control does not exist.
How to use GitHub with PHI
A BAA is one part of a shared-responsibility arrangement. The vendor's terms are one half. Your configuration and policies are the other. The HIPAA guides cover the wider process. For a development team at a clinic or digital-health company, the practical checklist looks like this:
- Keep PHI out of every GitHub surface unless a signed BAA exists. That includes repositories, issues, comments, commit history, Actions logs and Copilot prompts. A common leak is a developer pasting a screenshot of an EHR error, with a patient name visible, into an issue.
- Use de-identified data for tests and fixtures. Never commit real patient exports, database dumps or sample claim files.
- Keep secrets out of code. Database credentials and API keys for PHI-handling systems do not belong in the repo, where they could expose the systems that hold PHI.
- Check Actions and debug output. A pipeline that prints a query result to a log can write PHI into build history.
- Get written confirmation from GitHub before any PHI use. Do not rely on assumptions about a plan tier, an owner company or a product name.
- Restrict access and manage offboarding. Remove departing contractors and developers promptly, and limit who can read private repositories.
- Train developers and set a written policy on what may never be pasted into code, issues or AI prompts.
Systems that process PHI should run on a vendor that signs a BAA. Compliance depends on the signed BAA, your configuration and your organization's policies.
Alternatives with a BAA
These vendors publish BAA terms. Each is a hosting or cloud platform rather than a code host, so a BAA with one of them does not cover your GitHub account. Browse more in HIPAA-compliant software development tools.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) |
| Microsoft Azure | Conditional | All Azure customers under a volume licensing or online subscription agreement (no plan tiers) |
| Firebase | Conditional | Google Cloud BAA (any billing account; Firebase services governed by Google Cloud Platform Terms) |
| Google Cloud Platform | Yes | All Google Cloud accounts |
| Heroku | Conditional | Heroku Shield Private Spaces (Enterprise) |
"Conditional" means the BAA applies only to specified services, plans or configurations. A BAA does not make an organization HIPAA compliant by itself. Read the exact covered-services list before moving PHI.
Sources
- No vendor source found: the vendor publishes no BAA terms on the pages checked.
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status for other vendors.
Does GitHub sign a BAA?
No BAA is published for any GitHub plan on the pages checked. This site does not state that GitHub will or will not sign one. The verdict is unknown. Get written confirmation from GitHub before any PHI use.
Is GitHub Copilot HIPAA compliant or covered by a BAA?
No public statement was found either way for GitHub Copilot. No BAA coverage is published, so Copilot prompts and suggestions should not include PHI.
Can I store PHI in a private GitHub repository?
No published BAA covers private repositories, so treat PHI as out of scope. That includes code, issues, comments, commit history and Actions logs. Use de-identified data instead.
What does an "unknown" verdict mean on this site?
Every verdict (yes, conditional, no or unknown) must cite the vendor's own BAA or trust page with a date. Where no source exists, the verdict is "unknown." It does not mean the vendor is non-compliant. It means no published terms were found to rely on.