Of nine developer platforms, only Google Cloud signs a BAA on every account without a plan requirement. Seven others are conditional on an account, plan, add-on or eligible-service limit, and GitHub's status is unknown. A BAA is tied to a specific service on an eligible account or plan, so the table below lists plan, how to obtain the BAA and the controls side by side.
HIPAA-compliant software development: vendors with a BAA compared
Nine vendors are listed in the table: 1 yes (Google Cloud), 7 conditional (AWS, Azure, Firebase, Vercel, Supabase, Heroku, Twilio) and 1 unknown (GitHub). No vendor is recorded as explicitly declining a BAA.
The seven conditional vendors split into two groups:
- Account-wide BAAs: AWS, Azure and Firebase (through the Google Cloud BAA) apply at the account level, but still only to eligible services.
- Plan-specific BAAs: Vercel (Pro plus add-on, or Enterprise), Supabase (Team plus add-on), Heroku (Shield Private Spaces) and Twilio (Security Edition) need a particular paid plan or product.
This page reports vendors' published terms. It is not legal advice and not an audit of any vendor. HIPAA Compliant Wiki is published by Chanty, Inc.; Chanty is a team-chat tool for staff, not a developer platform, and does not appear in this table. Other categories are listed under HIPAA-compliant software by category.
Quick answer: which developer platforms sign a BAA, and from which plan
Each vendor name links to its entry. The full list is at Is it HIPAA compliant? All vendors. For what the agreement itself must contain, see the guide to the business associate agreement.
- Google Cloud: yes. BAA on all accounts, accepted online.
- AWS: conditional. BAA on all accounts via AWS Artifact. PHI belongs only in HIPAA-eligible services.
- Azure: conditional. BAA included through the licensing agreement and the DPA.
- Firebase: conditional. Covered through the Google Cloud BAA.
- Vercel: conditional. Pro plus the BAA add-on, or Enterprise.
- Supabase: conditional. Team plus the paid HIPAA add-on.
- Heroku: conditional. Shield Private Spaces (Enterprise).
- Twilio: conditional. Security Edition.
- GitHub: unknown. No source for BAA terms.
Comparison table
Rows follow a fixed order and are not a ranking. A dash means the vendor has no plan to report.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Google Cloud Platform | Yes | All Google Cloud accounts | Review and accept the Google Cloud BAA online (see Privacy compliance and records for Google Cloud) | Not published by the vendor | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-20 |
| Vercel | Conditional | Pro | Pro: purchase the HIPAA BAA add-on under Settings > Billing; Enterprise: request through Customer Success Manager / Account Executive or sales | $20/user/month (Pro) plus $350/month HIPAA BAA add-on | Yes | Yes | Yes | Yes | 2026-10-28 |
| Supabase | Conditional | Team | Request via Supabase HIPAA form (forms.supabase.com/hipaa2); organization signs a BAA and enables the paid HIPAA add-on | $599/month (Team) plus paid HIPAA add-on | Not published by the vendor | Yes | Yes | Yes | 2026-10-28 |
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) | Sign in to AWS Artifact in the AWS Management Console, review and accept the Business Associate Addendum for the account, or accept it once for all accounts in an AWS Organization; PHI must then be processed only in HIPAA-eligible services. | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Yes | 2026-10-19 |
| Microsoft Azure | Conditional | All Azure customers under a volume licensing or online subscription agreement (no plan tiers) | No separate contract: executing the customer's licensing agreement, which incorporates the Microsoft Product Terms and the Microsoft Products and Services Data Protection Addendum (DPA), includes execution of the HIPAA BAA. The BAA text is on the Service Trust Portal (aka.ms/baa). | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Yes | 2026-10-19 |
| Firebase | Conditional | Google Cloud BAA (any billing account; Firebase services governed by Google Cloud Platform Terms) | Accept the Google Cloud BAA for the Google Cloud project per the 'Privacy compliance and records for Google Cloud' instructions; no separate Firebase BAA | Pay-as-you-go Google Cloud pricing (no additional charge stated for the BAA) | Yes | Not published by the vendor | Not published by the vendor | Yes | 2026-10-28 |
| Heroku | Conditional | Heroku Shield Private Spaces (Enterprise) | Create a support ticket to complete a Business Associate Addendum with Heroku; Shield Private Spaces are sold through Heroku Enterprise sales | Not published by the vendor | Not published by the vendor | Yes | Not published by the vendor | Yes | 2026-10-28 |
| Twilio | Conditional | Security Edition | Contact Twilio Account Representative or Contact Sales; BAA is an addendum to Twilio's Terms of Service | Not published by the vendor | Not published by the vendor | Yes | Yes | Not published by the vendor | 2026-10-28 |
| GitHub | Unknown | — | — | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
Vendors that do not sign a BAA
None of the nine vendors is recorded as refusing a BAA.
GitHub is the one entry without a verdict. No BAA terms or vendor source are on record, so this page claims nothing either way: the status is unknown, not no. Treat unknown as "do not put PHI there until the vendor confirms in writing." Source code, issue trackers and commit messages can all end up containing PHI, for example a patient identifier pasted into a bug report.
The usual exclusions elsewhere are free and hobby tiers, services outside the vendor's eligible list, and preview features. When a status changes, it is logged under recent changes in vendor HIPAA status.
What counts as HIPAA-compliant developer platforms
A platform that stores or processes PHI must sign a BAA for the specific services you use, on an eligible account or plan. That covers hosting, serverless functions, databases, messaging APIs and source control. A vendor name alone tells you nothing, so this page reports "BAA available on plan X for services Y" and does not describe any vendor as "HIPAA compliant" or "HIPAA certified." HIPAA has no certification.
Most clouds publish a HIPAA-eligible services list. A service outside that list stays out of scope even after the BAA is signed. AWS is the clearest example in the table: the BAA is on every account, but PHI belongs only in eligible services. Eligible also does not mean compliant: how you configure access, logging and encryption decides that. The guide on HIPAA-eligible vs HIPAA-compliant walks through the difference.
How to choose a developer platform for PHI
- Map the BAA to every service in your architecture. List compute, database, storage, messaging and logging, and confirm each one is covered. A clinic scheduling app that uses Twilio for reminders needs the Twilio BAA (Security Edition) as well as the hosting BAA.
- Budget for the plan. Vercel needs Pro plus the add-on, or Enterprise. Supabase needs Team plus the HIPAA add-on. Heroku needs Shield Private Spaces. These costs belong in the estimate from the start, not after launch.
- Check how the BAA is obtained and the lead time. Google Cloud is accepted online, AWS goes through AWS Artifact, and Azure comes through the licensing agreement and DPA. Where the table says, confirm the route before a launch date depends on it.
- Verify the controls you need: encryption at rest, audit log, SSO and the SOC 2 report. Fill gaps only from vendor-published documents.
- Keep free tiers and preview features away from PHI. Test with synthetic data, and map each third-party integration to its own BAA.
- Write down shared responsibility. Configuration, access management, offboarding and staff policies stay with you. The guide to HIPAA-compliant app requirements lists what to document.
Related
FAQ
Which cloud platforms sign a BAA on every account?
Google Cloud signs on all accounts, and the BAA is accepted online. AWS also offers its BAA on all accounts through AWS Artifact, but PHI belongs only in HIPAA-eligible services. Azure includes the BAA through its licensing agreement and DPA. See Google Cloud, AWS and Azure.
Which developer platforms require a paid plan or add-on for a BAA?
- Vercel: Pro plus the BAA add-on, or Enterprise.
- Supabase: Team plus the paid HIPAA add-on.
- Heroku: Shield Private Spaces (Enterprise).
- Twilio: Security Edition.
Does Firebase have its own BAA, or does it use the Google Cloud BAA?
Firebase is covered through the Google Cloud BAA. Per the table, there is no separate Firebase agreement. Details are on the Firebase entry.
Is signing a BAA enough to put PHI in any service on that platform?
No. The BAA applies to the services the vendor lists as eligible, on an eligible account or plan. Services outside that list, free tiers and preview features stay out of scope, and your own configuration and access controls remain your responsibility.