Conditional As of 2026-10-28, Firebase has no BAA of its own, but a BAA is available through the Google Cloud BAA on any billing account. The main exclusion is that Firebase-branded services such as Realtime Database, Firebase Authentication and Hosting are not on Google's covered-products list. The answer is per service, not per brand, so a BAA is available for named services only. See all vendor HIPAA checks for other tools.
Short answer
There is no Firebase-specific BAA. The Google Cloud BAA covers Firestore, Identity Platform, Cloud Run functions and Cloud Storage. Firebase services are governed by the Google Cloud Platform Terms. For the terms behind "BAA" and "PHI", see the HIPAA glossary: BAA and PHI.
Cloud Messaging is not named on the covered list used for this check. Do not assume it is covered.
Which plans include a BAA
Firebase has no plan tiers that change BAA availability. Use is billed under pay-as-you-go Google Cloud pricing, and the BAA attaches to the Google Cloud project.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Google Cloud BAA (any billing account) | Available | Accepted for the Google Cloud project, following the instructions in "Privacy compliance and records for Google Cloud". | None stated; same pricing |
| Separate Firebase BAA | Does not exist | Not applicable | Not applicable |
No plan is excluded from the BAA in the sources reviewed.
What the BAA covers and what it excludes
Google's covered-products list is the source of truth. For general context on Google's position across its products, see Is Google HIPAA compliant?.
Covered Firebase-related services
- Firestore
- Firestore in Datastore mode
- Identity Platform
- Cloud Run functions
- Cloud Storage
Not covered, or not on the list
- Realtime Database
- Firebase Authentication. Only Identity Platform is listed. Do not put PHI in custom attributes or send it through client SDKs.
- Hosting
- Crashlytics
- Analytics and other Firebase-branded services
- Pre-GA offerings
- Anonymous accounts that carry PHI
Google's guidance on optional and custom attributes and on SDKs applies directly to patient-facing apps:.
Clinic examples:
- Intake app. A patient intake form saved to Firestore, with uploaded insurance card images in Cloud Storage, uses covered services. Show the same form's waiting-room status from Realtime Database and you have PHI in an uncovered service.
- Push messages. A push message such as "Your lab result for [name] is ready" puts PHI in a payload. Cloud Messaging is not confirmed as covered, so keep payloads generic ("You have a new message").
- Analytics events. An Analytics event named after a diagnosis puts PHI in an uncovered service.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
"Not published by the vendor" means this check found no published statement in the sources used. It does not mean the control is absent.
How to use Firebase with PHI
Responsibility is shared. Google signs the BAA and operates the covered services. Your organization configures them and sets the policies. This checklist is a starting point; the HIPAA guides cover the surrounding program.
- Accept the Google Cloud BAA for the project before any PHI enters it.
- Use only covered services: Firestore, Datastore mode, Identity Platform, Cloud Run functions and Cloud Storage.
- Keep PHI out of Realtime Database, Hosting, Analytics, Crashlytics and push notification payloads.
- Keep PHI out of Identity Platform custom attributes, and avoid its client SDKs for PHI.
- Avoid pre-GA features, and do not attach PHI to anonymous accounts.
- Manage user access, offboarding and device security in the project.
- Train staff and developers on what may and may not be logged, stored or sent.
Compliance depends on the signed BAA, your configuration and your policies. Covered services alone do not make an app HIPAA compliant.
Alternatives with a BAA
If your design needs services outside the covered list, these backends offer a BAA. Each verdict reflects the vendor's own terms; see the individual check for scope.
- Amazon Web Services: conditional. Is AWS HIPAA compliant?
- Microsoft Azure: conditional.
- Google Cloud Platform: yes.
- Heroku: conditional, with Shield Private Spaces.
- Supabase: conditional, on the Team plan.
Browse HIPAA-compliant software by category for the software-development category.
Sources
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-28. "The Google Cloud BAA includes Google Cloud's entire infrastructure (all regions, all zones, all network paths, all points of presence) and the following products:"
- HIPAA compliance on Google Cloud and Google Workspace — BAA page, checked 2026-10-28. "Don't store PHI in optional or custom attributes, such as display names or photo URLs. Don't use Identity Platform SDKs and client libraries when interacting with, managing, or storing PHI."
- Privacy and Security in Firebase — Trust center, checked 2026-10-28. "Firebase services encrypt data in transit using HTTPS and logically isolate customer data."
- Privacy and Security in Firebase — Trust center, checked 2026-10-28. "All Firebase services have successfully completed the ISO 27001 and SOC 1, SOC 2, and SOC 3 evaluation process, and some have also completed the ISO 27017 and ISO 27018 certification process."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Is there a separate Firebase BAA?
No. Firebase has no BAA of its own. The BAA is the Google Cloud BAA, available on any billing account and accepted for the Google Cloud project. Firebase services are governed by the Google Cloud Platform Terms.
Is Firebase Cloud Messaging covered by the BAA?
Cloud Messaging is not named on the covered list used for this check, so do not treat it as covered. Keep PHI out of push payloads regardless: send generic alerts and retrieve details inside the app from a covered service.
Can I store PHI in Firebase Realtime Database or use Firebase Authentication?
Not on this verdict. Realtime Database is not on the covered list. Firebase Authentication is not listed either; only Identity Platform is, and even there PHI should stay out of custom attributes and client SDKs.
Does signing the Google Cloud BAA cost extra?
No extra cost is stated. The same pay-as-you-go Google Cloud pricing applies.