No No BAA is available on any Shopify plan, and Shopify's Acceptable Use Policy lists uploading PHI subject to HIPAA as an unsupported business activity. Last verified 2026-10-28; next check 2027-01-28. For tools that do offer a BAA, see Is it HIPAA compliant? All vendors.
Short answer
Shopify publishes no BAA on any plan. Its Acceptable Use Policy names the upload of PHI as unsupported, and no BAA terms appear in its Terms of Service. The finding is narrow: PHI is not a supported use, whatever the plan. It is not a judgment on Shopify as a commerce platform. In practice, do not put PHI into Shopify. For definitions of the terms used here, see the HIPAA glossary entries for BAA and PHI.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Not available | None published | Not published by the vendor |
| Basic | Not available | None published | Not published by the vendor |
| Shopify | Not available | None published | Not published by the vendor |
| Advanced | Not available | None published | Not published by the vendor |
| Plus | Not available | None published | Not published by the vendor |
BAA available on plan: none. Services covered: none.
What the BAA covers and what it excludes
Covered services: none, because no BAA is published.
Excluded, with uploading PHI not supported under the Acceptable Use Policy:
- Online store
- Checkout
- Customer records
- Apps
For a clinic, this means order forms, customer notes and checkout fields should not collect health information. Examples are a diagnosis, a prescription detail or a treatment note attached to an order. Whether an order becomes PHI depends on the organization's status and the data involved, so the privacy officer should decide that before launch.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Status as of 2026-10-28. Even a strong control set would not substitute for a BAA. Without one, a vendor is not a permitted place for PHI.
How to use Shopify with PHI
Shopify should not receive PHI. Responsibility for keeping it out sits with the customer:
- Keep PHI out of the store, checkout, customer records and apps.
- Move any health data collection, such as intake questions or prescription details, into a separate tool that has a signed BAA.
- Review third-party apps for PHI exposure. An app that reads order or customer data can carry health information out of the store.
- Train staff on what must not be entered, including order notes, customer tags and free-text checkout fields.
- Document the decision in the vendor inventory, with the verdict and the verification date.
- Re-check the Acceptable Use Policy at the next review.
Compliance depends on the signed BAA, configuration and policies, and here no BAA exists. More checklists are in the HIPAA guides.
Alternatives with a BAA
These website and commerce-adjacent vendors have a BAA available on a specific plan or add-on. Each verdict is conditional, so read the vendor page for the covered services and exclusions.
- Bubble: conditional. BAA available with the Dedicated Enterprise HIPAA add-on. No Bubble page is published on this site yet.
- GoDaddy: conditional. Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. See Is GoDaddy HIPAA compliant?
- Squarespace: conditional. Acuity Scheduling on the Premium or Powerhouse plan. See Is Squarespace HIPAA compliant?
- Wix: conditional. BAA available on the Business plan. See Is Wix HIPAA compliant?
For other categories, see HIPAA-compliant software by category.
Sources
- Shopify Acceptable Use Policy – Shopify — Terms, checked 2026-10-28. "You must likewise respect that certain business activities are not supported by our platform, such as uploading Protected Health Information subject to HIPAA."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Shopify sign a BAA?
No BAA is published on any Shopify plan, and no BAA terms appear in the Terms of Service. The Acceptable Use Policy lists uploading PHI subject to HIPAA as unsupported.
Can I collect patient information through a Shopify checkout or customer record?
No. Checkout and customer records are within the scope the Acceptable Use Policy does not support for PHI. Keep health details out of order notes, checkout fields and customer tags, and collect them in a tool with a signed BAA.
Does Shopify Plus include a BAA?
No BAA is published for Plus. Plus is listed in the table above with the same result as the other plans: no BAA, no covered services.
Which website builders have a BAA available?
Conditional options are Bubble (Dedicated Enterprise HIPAA add-on), Wix (Business plan), Squarespace (through Acuity Scheduling Premium or Powerhouse) and GoDaddy (Microsoft 365 email on plans it represents as HIPAA-compliant). Each covers specific services only, so check the individual vendor pages before putting PHI in.