agencypartner.com

As of **August 2026, Bubble is not yet HIPAA compliant**. Bubble itself says HIPAA compliance is **in progress**, with a target of **the second half of 2026**, and that HIPAA functionality is expected to be an **Enterprise/dedicated-plan feature**. [bubble.io](https://bubble.io/blog/april-2026-founder-ama/?utm_source=chatgpt.com) There’s an especially important issue if you're building a healthcare app: - **You should not assume a Bubble app is HIPAA compliant simply because you use HIPAA-compliant AWS services or another compliant backend.** - HIPAA compliance applies to the **entire system and the parties handling PHI**, not merely where the database is hosted. - Bubble's current Terms state that its services are **not tailored to comply with HIPAA** and say that if your interactions are subject to HIPAA, you may not use the Services. [e0845b89cf6f83c04d7338cfe5f77a8b.cdn.bubble.io](https://e0845b89cf6f83c04d7338cfe5f77a8b.cdn.bubble.io/f1697752102237x838918827908980500/Terms%20%26%20Condition%20.pdf?utm_source=chatgpt.com) - Bubble does have a DPA and publishes its subprocessors, but that is **not the same thing as having a HIPAA BAA/compliant platform**. [bubble.io](https://bubble.io/dpa?utm_source=chatgpt.com) ### If you're considering Bubble for a healthcare app I'd currently treat it as: **Bubble + PHI = ❌ Don't do this yet** unless Bubble has specifically offered you a HIPAA-enabled Enterprise arrangement and executed the necessary agreements. **Bubble for non-PHI functionality + separate HIPAA-compliant system for PHI = potentially workable**, but you'd need to architect the application so PHI doesn't flow through Bubble or its non-HIPAA subprocessors. If you tell me **what you're building** (e.g., patient portal, therapy app, clinical workflow, scheduling, telehealth, healthcare AI), I can map out a **HIPAA-safe Bubble architecture** and identify which data can/can't go through Bubble.

For a small practice, I’d choose the vendor **less like a normal software-development contractor and more like a security-sensitive healthcare technology partner**. “HIPAA compliant” on a sales page is not enough. The key point: **HIPAA compliance is shared responsibility.** Your practice still has its own risk-analysis and security obligations, while a vendor that creates, receives, maintains, or transmits ePHI on your behalf will generally be a business associate and should sign a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 1. Define exactly what the portal will handle Before talking to vendors, document: - Patient registration/intake - Secure patient-provider messaging - Appointment requests/reminders - Forms and consents - Lab results or clinical documents - Billing/payment information - Telehealth, if applicable - File uploads/downloads - Integration with your EHR/EMR - Whether staff can access the portal from phones/home computers - What data must be retained and for how long Also identify **where ePHI enters, travels, is stored, and leaves the system**. That becomes the basis for evaluating vendors and your practice's risk analysis. HHS specifically says the risk analysis should cover all ePHI created, received, maintained, or transmitted, including ePHI handled by vendors. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 2. Make the BAA a requirement before selecting the finalist Ask each vendor: > “Will you sign a HIPAA-compliant Business Associate Agreement covering all services through which you will create, receive, maintain, or transmit our PHI?” A **“yes” is necessary but not sufficient**. Your BAA should address things such as permitted PHI uses, safeguards, breach reporting, subcontractors, assistance with patient rights, and what happens to PHI when the relationship ends. HHS provides a useful description of the required BAA provisions. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) Be wary if the vendor: - Says a BAA isn't necessary - Sends you a generic “HIPAA certification” - Says HIPAA compliance is entirely your responsibility - Won't identify subcontractors that can access PHI - Won't explain how data is deleted/exported when you leave ### 3. Ask for evidence, not promises I'd send finalists a security questionnaire and ask them to provide evidence where appropriate. At minimum, investigate: | Area | What I'd want to know | |---|---| | **Encryption** | Encryption in transit and at rest? | | **Authentication** | MFA for staff/admins? Strong patient authentication? | | **Access control** | Unique accounts, least privilege, role-based access? | | **Audit logs** | Who accessed/changed/downloaded PHI, and can you review logs? | | **Backups** | How often? Encrypted? Tested restoration? | | **Disaster recovery** | Recovery objectives and documented procedures? | | **Vulnerability management** | Regular scanning and patching? | | **Pen testing** | Independent penetration testing? How often? | | **Incident response** | Written incident/breach response process? | | **Subprocessors** | Who else can access/store/process your data? | | **Data location** | Where is production data and backup data hosted? | | **Data deletion** | What happens when you terminate the contract? | | **Business continuity** | What happens if the vendor goes out of business? | | **Integrations** | How are APIs authenticated and authorized? | | **Support** | Can support personnel see patient data? Under what circumstances? | Don't automatically reject a vendor because they won't give you their entire security architecture. HHS notes that HIPAA doesn't specifically require a business associate to provide customers with security documentation or audit rights, but customers can contract for additional assurances based on their risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) For a small practice, I'd therefore prioritize vendors willing to provide **meaningful independent assurance**, such as a recent SOC 2 Type II report, penetration-test summary, security documentation, or equivalent evidence. ### 4. Don't confuse encryption with HIPAA compliance A vendor saying “AES-256 encryption” isn't enough. HHS explicitly points out that encryption alone doesn't address availability, integrity, administrative safeguards, physical safeguards, disaster recovery, access controls, etc. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) For example, I'd rather have: **Encryption + MFA + audit logging + tested backups + incident response + access controls + BAA** than a vendor whose entire security pitch is: **“We use encrypted cloud storage.”** ### 5. Evaluate the actual patient experience Security shouldn't make the portal unusable. Have the vendor demonstrate the actual workflow: **Patient → creates account → verifies identity → logs in → receives message → uploads document → provider responds → patient downloads document.** Then test unusual situations: - Patient forgets password - Patient changes email/phone - Staff member leaves the practice - Patient accidentally uploads the wrong document - Provider sends something to the wrong patient - Patient has multiple family members using the practice - Staff member needs temporary access - A patient requests their records - The practice needs to export everything and leave the platform This often exposes weaknesses that aren't apparent in a security questionnaire. ### 6. Pay special attention to integrations If the portal connects to your EHR, practice-management system, labs, payment processor, or other systems, determine **exactly what data crosses each integration**. Ask: - Is the integration API-based? - Who authenticates the connection? - Are credentials/secrets rotated? - Is data minimized? - Are failed transactions logged? - Can a compromised portal account access the EHR? - Can the vendor's developers access production data? - Is the integration covered by the BAA? This is particularly important because a portal can be secure in isolation but create a serious vulnerability through an overly privileged integration. ### 7. Make data ownership and exit terms contractual This is one of the most overlooked issues for small practices. Your contract should clearly establish that **the practice retains ownership/control of its patient data**, and specify: - Export format - Export fees - Export timeframe - Assistance with migration - Data deletion timeline - Backup deletion - What happens to data after termination - Whether the vendor can retain de-identified/derived data - What happens if the vendor shuts down HHS's BAA guidance specifically contemplates return or destruction of PHI at termination, where feasible. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 8. Score vendors instead of choosing based on the demo I'd use a weighted scorecard something like: | Criterion | Weight | |---|---:| | Security architecture & controls | **25%** | | HIPAA/BAA & contractual protections | **20%** | | Reliability, backup & disaster recovery | **15%** | | EHR/integration capabilities | **10%** | | Patient usability/accessibility | **10%** | | Vendor experience/support | **10%** | | Price/TCO | **10%** | I'd make certain requirements **pass/fail**, rather than allowing a cheap price to compensate for them: **Pass/fail:** - Will sign BAA - Appropriate security controls - Adequate incident/breach provisions - Can export your data - Acceptable subcontractor arrangements - Meets your practice's risk assessment ### 9. Watch for these red flags I'd probably eliminate a vendor if it says: > “We're HIPAA certified.” …but can't explain **how**. Other red flags: - No BAA - No MFA for administrators - Shared administrator accounts - No audit trail - No documented incident-response process - No tested backup/recovery strategy - Developers routinely access production PHI - Refuses to explain subprocessors - Can't explain data deletion - Locks you into proprietary data formats - Extremely vague answers about security - Security depends primarily on the practice configuring everything correctly - Vendor won't allow your security/privacy counsel to review the contract ### 10. For a small practice, consider buying rather than building Unless your requirements are unusually specialized, I'd seriously investigate an **existing healthcare portal platform** before commissioning a custom application. Custom development creates a much larger ongoing responsibility: secure architecture, dependency management, vulnerability remediation, monitoring, incident response, backups, access controls, compliance documentation, and maintenance. HIPAA compliance is an ongoing process—not something a developer can simply “build into” version 1. HHS describes risk analysis as foundational and ongoing. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you do need custom development, I'd strongly prefer a vendor with **demonstrable healthcare/HIPAA experience** over a general software agency that says it can “make the application HIPAA compliant.” ### My practical selection process I'd narrow it to **3 vendors**, then give each exactly the same requirements and questionnaire: **1. Requirements → 2. Security questionnaire → 3. BAA/contract review → 4. Architecture/security review → 5. Live workflow demo → 6. Reference checks → 7. Pilot → 8. Final risk assessment → 9. Contract → 10. Production launch** And I'd have your healthcare attorney/privacy counsel review the BAA and contract, while someone technically competent reviews the security architecture. HHS currently provides a Security Risk Assessment Tool specifically intended to help small and medium-sized healthcare practices and business associates conduct this kind of assessment. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **Bottom line:** Don't ask vendors *“Are you HIPAA compliant?”* Ask **“Show me how your system protects our ePHI, tell me exactly which responsibilities remain with us, give me the BAA and security evidence, and show me what happens when something goes wrong.”** That will produce a much better vendor decision. If you want, I can also give you a **vendor RFP/questionnaire specifically for a small practice**, with ~40 questions you can send to vendors and a scoring rubric. | Area | What I'd want to know | |---|---| | **Encryption** | Encryption in transit and at rest? | | **Authentication** | MFA for staff/admins? Strong patient authentication? | | **Access control** | Unique accounts, least privilege, role-based access? | | **Audit logs** | Who accessed/changed/downloaded PHI, and can you review logs? | | **Backups** | How often? Encrypted? Tested restoration? | | **Disaster recovery** | Recovery objectives and documented procedures? | | **Vulnerability management** | Regular scanning and patching? | | **Pen testing** | Independent penetration testing? How often? | | **Incident response** | Written incident/breach response process? | | **Subprocessors** | Who else can access/store/process your data? | | **Data location** | Where is production data and backup data hosted? | | **Data deletion** | What happens when you terminate the contract? | | **Business continuity** | What happens if the vendor goes out of business? | | **Integrations** | How are APIs authenticated and authorized? | | **Support** | Can support personnel see patient data? Under what circumstances? | Don't automatically reject a vendor because they won't give you their entire security architecture. HHS notes that HIPAA doesn't specifically require a business associate to provide customers with security documentation or audit rights, but customers can contract for additional assurances based on their risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) For a small practice, I'd therefore prioritize vendors willing to provide **meaningful independent assurance**, such as a recent SOC 2 Type II report, penetration-test summary, security documentation, or equivalent evidence. ### 4. Don't confuse encryption with HIPAA compliance A vendor saying “AES-256 encryption” isn't enough. HHS explicitly points out that encryption alone doesn't address availability, integrity, administrative safeguards, physical safeguards, disaster recovery, access controls, etc. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) For example, I'd rather have: **Encryption + MFA + audit logging + tested backups + incident response + access controls + BAA** than a vendor whose entire security pitch is: **“We use encrypted cloud storage.”** ### 5. Evaluate the actual patient experience Security shouldn't make the portal unusable. Have the vendor demonstrate the actual workflow: **Patient → creates account → verifies identity → logs in → receives message → uploads document → provider responds → patient downloads document.** Then test unusual situations: - Patient forgets password - Patient changes email/phone - Staff member leaves the practice - Patient accidentally uploads the wrong document - Provider sends something to the wrong patient - Patient has multiple family members using the practice - Staff member needs temporary access - A patient requests their records - The practice needs to export everything and leave the platform This often exposes weaknesses that aren't apparent in a security questionnaire. ### 6. Pay special attention to integrations If the portal connects to your EHR, practice-management system, labs, payment processor, or other systems, determine **exactly what data crosses each integration**. Ask: - Is the integration API-based? - Who authenticates the connection? - Are credentials/secrets rotated? - Is data minimized? - Are failed transactions logged? - Can a compromised portal account access the EHR? - Can the vendor's developers access production data? - Is the integration covered by the BAA? This is particularly important because a portal can be secure in isolation but create a serious vulnerability through an overly privileged integration. ### 7. Make data ownership and exit terms contractual This is one of the most overlooked issues for small practices. Your contract should clearly establish that **the practice retains ownership/control of its patient data**, and specify: - Export format - Export fees - Export timeframe - Assistance with migration - Data deletion timeline - Backup deletion - What happens to data after termination - Whether the vendor can retain de-identified/derived data - What happens if the vendor shuts down HHS's BAA guidance specifically contemplates return or destruction of PHI at termination, where feasible. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 8. Score vendors instead of choosing based on the demo I'd use a weighted scorecard something like: | Criterion | Weight | |---|---:| | Security architecture & controls | **25%** | | HIPAA/BAA & contractual protections | **20%** | | Reliability, backup & disaster recovery | **15%** | | EHR/integration capabilities | **10%** | | Patient usability/accessibility | **10%** | | Vendor experience/support | **10%** | | Price/TCO | **10%** | I'd make certain requirements **pass/fail**, rather than allowing a cheap price to compensate for them: **Pass/fail:** - Will sign BAA - Appropriate security controls - Adequate incident/breach provisions - Can export your data - Acceptable subcontractor arrangements - Meets your practice's risk assessment ### 9. Watch for these red flags I'd probably eliminate a vendor if it says: > “We're HIPAA certified.” …but can't explain **how**. Other red flags: - No BAA - No MFA for administrators - Shared administrator accounts - No audit trail - No documented incident-response process - No tested backup/recovery strategy - Developers routinely access production PHI - Refuses to explain subprocessors - Can't explain data deletion - Locks you into proprietary data formats - Extremely vague answers about security - Security depends primarily on the practice configuring everything correctly - Vendor won't allow your security/privacy counsel to review the contract ### 10. For a small practice, consider buying rather than building Unless your requirements are unusually specialized, I'd seriously investigate an **existing healthcare portal platform** before commissioning a custom application. Custom development creates a much larger ongoing responsibility: secure architecture, dependency management, vulnerability remediation, monitoring, incident response, backups, access controls, compliance documentation, and maintenance. HIPAA compliance is an ongoing process—not something a developer can simply “build into” version 1. HHS describes risk analysis as foundational and ongoing. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you do need custom development, I'd strongly prefer a vendor with **demonstrable healthcare/HIPAA experience** over a general software agency that says it can “make the application HIPAA compliant.” ### My practical selection process I'd narrow it to **3 vendors**, then give each exactly the same requirements and questionnaire: **1. Requirements → 2. Security questionnaire → 3. BAA/contract review → 4. Architecture/security review → 5. Live workflow demo → 6. Reference checks → 7. Pilot → 8. Final risk assessment → 9. Contract → 10. Production launch** And I'd have your healthcare attorney/privacy counsel review the BAA and contract, while someone technically competent reviews the security architecture. HHS currently provides a Security Risk Assessment Tool specifically intended to help small and medium-sized healthcare practices and business associates conduct this kind of assessment. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **Bottom line:** Don't ask vendors *“Are you HIPAA compliant?”* Ask **“Show me how your system protects our ePHI, tell me exactly which responsibilities remain with us, give me the BAA and security evidence, and show me what happens when something goes wrong.”** That will produce a much better vendor decision. If you want, I can also give you a **vendor RFP/questionnaire specifically for a small practice**, with ~40 questions you can send to vendors and a scoring rubric.