Conditional Verified 2026-10-28. A BAA is available for Heroku Shield Private Spaces (Enterprise) with Shield data services. Common Runtime and non-Shield Private Spaces are excluded. See all vendor HIPAA checks for other platforms.
Short answer
Heroku signs a BAA on request through a support ticket. PHI belongs only inside Shield Private Spaces, using Shield Postgres, Shield Kafka and Shield Redis (Key-Value Store). Shield Private Spaces cost extra and are sold through Heroku Enterprise sales.
A clinic's scheduling app running on a standard dyno, or on a standard Private Space, is outside the BAA. Moving that app to Shield is a migration project, not a settings change.
Which plans include a BAA
BAA available on Heroku Shield Private Spaces (Enterprise) for the services listed in the next section.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Heroku Shield Private Spaces (Enterprise) | Available | Support ticket to complete a Business Associate Addendum | Yes, custom pricing through a Solution Engineer or Account Executive |
| Common Runtime (Eco, Basic, Standard, Performance dynos) | Not covered | Not available; excluded under the BAA restrictions | Not published by the vendor |
| Private Spaces (non-Shield) | Not covered | Not available; excluded under the BAA restrictions | Not published by the vendor |
No Shield Private Spaces price is published. Pricing is quoted per customer.
What the BAA covers and what it excludes
Covered by the BAA:
- Shield Private Spaces
- Shield Dynos
- Shield Postgres
- Shield Connect
- Apache Kafka on Heroku Shield
- Shield Key-Value Store (Redis)
- Heroku Managed Inference and Agents
Excluded from the BAA:
- Common Runtime
- Non-Shield Private Spaces (Cedar and Fir)
- Non-Shield Postgres
- Connect (non-Shield)
- Kafka (non-Shield)
- Key-Value Store (non-Shield)
Do not put PHI in Kafka topic names or ACLs, even on Shield Kafka. Names such as patient-12345-labs expose identifiers outside the protected data stream. Use opaque topic names and keep PHI in message payloads.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
"Not published by the vendor" means no statement was found in the sources below. It does not mean the control is absent. Ask Heroku for specifics during the BAA process.
How to use Heroku with PHI
A BAA is one part of a shared-responsibility model. Use this checklist:
- Sign the BAA before any PHI reaches the platform. Open the support ticket first. See the Business Associate Agreement and PHI definitions if your team needs the terms.
- Move to Shield Private Spaces and Shield data services only. An app that uses Shield dynos but standard Postgres still sends PHI to an excluded service.
- Keep PHI out of Common Runtime, add-ons and Kafka topic names and ACLs. This includes logs, error reports and test data copied from production.
- Configure access and offboarding. Limit who can reach Shield apps and data, and remove access the day a developer or contractor leaves.
- Confirm that every add-on and third-party service touching PHI has its own BAA. Automation tools sit outside a Heroku BAA; see Is Zapier HIPAA compliant? for an example of a vendor check.
- Train staff and set policies. Cover what developers may paste into tickets, consoles and chat. The HIPAA guides include shared-responsibility material.
Compliance depends on the signed BAA, your configuration and your policies, not on the platform alone.
Alternatives with a BAA
These platforms also offer a BAA. Check each plan's scope before moving PHI.
- Amazon Web Services: conditional; BAA available on all accounts for eligible services. See Is AWS HIPAA compliant?.
- Microsoft Azure: conditional.
- Firebase: conditional; covered under the Google Cloud BAA.
- Google Cloud Platform: yes.
- Supabase: conditional; Team plan.
For more categories, see HIPAA-compliant software by category.
Sources
- Heroku's ISO, SOC, HIPAA, PCI Compliance and Certifications — Trust center, checked 2026-10-28. "Customers who want to build healthcare applications on Heroku that comply with US HIPAA requirements should create a ticket to complete a Business Associate Addendum with Heroku."
- Business Associate Addendum Restrictions — Terms, checked 2026-10-28. "PHI must only be handled inside Shield Private Spaces. Standard Private Spaces and the Common Runtime are not covered by the BAA."
- Business Associate Addendum Restrictions — Terms, checked 2026-10-28. "No other Heroku Postgres plans are covered under the BAA."
- Shield Private Spaces | Heroku Dev Center — Help article, checked 2026-10-28. "Shield Private Spaces come at an additional cost, and it is recommended that you consult your Solution Engineer or Account Executive to decide if a Shield Private Space is appropriate for your application requirements."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Heroku sign a BAA?
Yes. You request it through a support ticket to complete a Business Associate Addendum. It applies to Heroku Shield Private Spaces and the Shield data services, not to the whole platform.
Can I put PHI on Heroku Common Runtime or standard Private Spaces?
No. Common Runtime and non-Shield Private Spaces (Cedar and Fir) are excluded under the BAA restrictions. The same applies to non-Shield Postgres, Connect, Kafka and Key-Value Store.
Which Heroku services are covered by the BAA?
Shield Private Spaces, Shield Dynos, Shield Postgres, Shield Connect, Apache Kafka on Heroku Shield, Shield Key-Value Store (Redis), and Heroku Managed Inference and Agents. PHI must not appear in Kafka topic names or ACLs.
Does Shield Private Spaces cost extra?
Yes. It is an additional cost with custom pricing, quoted through a Heroku Solution Engineer or Account Executive. No list price is published.