atlantic.net

Yes. The list is shorter than you might expect, because **“HIPAA-ready” and “will sign a BAA” are not the same thing**. If a platform creates, receives, maintains, or transmits ePHI on your behalf, HHS says you generally need a BAA with that provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### No-code / low-code platforms that can support a BAA | Platform | BAA? | Important caveat | |---|---|---| | **[Airtable](https://www.airtable.com?utm_source=chatgpt.com)** | **Yes** | HIPAA is currently limited to **Enterprise Scale**; you execute Airtable's Health Information Exhibit/BAA. [www.airtable.com](https://www.airtable.com/company/hipaa-airtable?utm_source=chatgpt.com) | | **[Superblocks](https://www.superblocks.com?utm_source=chatgpt.com)** | **Yes** | Explicitly says it will sign a BAA with HIPAA-covered customers. More low-code than pure no-code. [docs.superblocks.com](https://docs.superblocks.com/enterprise/security/hipaa?utm_source=chatgpt.com) | | **[WeWeb](https://www.weweb.io?utm_source=chatgpt.com)** | **Potentially / architecture-dependent** | Particularly attractive if you keep PHI in your own HIPAA-eligible backend and use WeWeb as the frontend. It supports self-hosting/export and emphasizes keeping data on your infrastructure. [www.weweb.io](https://www.weweb.io/blog/hipaa-compliant-app-builder-choosing-guide?utm_source=chatgpt.com) | | **[AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) + AWS** | **Yes, at AWS level** | AWS has a BAA and lists Amplify among HIPAA-eligible services. You still have to configure the architecture correctly. [aws.amazon.com](https://aws.amazon.com/tr/compliance/hipaa-eligible-services-reference/?utm_source=chatgpt.com) | | **[Mendix](https://www.mendix.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Enterprise low-code platform with HIPAA support; substantially heavier than typical startup no-code tools. | | **[ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Strong choice if you're already in ServiceNow; expensive/overkill for most small projects. [www.superblocks.com](https://www.superblocks.com/blog/ai-governance-features-low-code-app-platforms?utm_source=chatgpt.com) | ### Platforms I'd *not* assume are BAA-capable **Bubble:** despite being popular for healthcare apps, Bubble currently says its platform and internal processes **do not meet HIPAA requirements and it does not support HIPAA-compliant apps**. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Framer:** explicitly says it isn't designed for HIPAA and shouldn't be used to process or store PHI. [www.framer.com](https://www.framer.com/help/articles/framer-hipaa-compliance/?utm_source=chatgpt.com) ### My shortlist If you're trying to build an actual **HIPAA-regulated application without traditional coding**, I'd narrow it to: 1. **Airtable** — easiest if your application is essentially a database/workflow/portal. 2. **Superblocks** — strongest if you're building internal healthcare tools, dashboards, CRUD apps, or operational software. 3. **WeWeb + HIPAA-eligible backend** — probably the most interesting option for a polished customer/patient-facing web application. 4. **AWS + a no-code frontend** — best if you want maximum control and are willing to have a more technical architecture. One important distinction: **getting a BAA does not make your application HIPAA compliant by itself.** Your authentication, authorization, audit logging, integrations, backups, data flows, breach procedures, workforce policies, and overall risk analysis still matter. HHS specifically notes that compliance is a shared responsibility and that customers need to understand and configure their cloud environment appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, intake form, clinician dashboard, scheduling app, internal CRM, AI app), I can narrow this to the **3 best no-code stacks that will actually work for that use case**, including approximate pricing and whether the BAA is available on a normal plan or only enterprise. [Airtable](https://www.airtable.com?utm_source=chatgpt.com) [Superblocks](https://www.superblocks.com?utm_source=chatgpt.com) [WeWeb](https://www.weweb.io?utm_source=chatgpt.com) [AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) [Mendix](https://www.mendix.com?utm_source=chatgpt.com) [ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com) | Platform | BAA? | Important caveat | |---|---|---| | **[Airtable](https://www.airtable.com?utm_source=chatgpt.com)** | **Yes** | HIPAA is currently limited to **Enterprise Scale**; you execute Airtable's Health Information Exhibit/BAA. [www.airtable.com](https://www.airtable.com/company/hipaa-airtable?utm_source=chatgpt.com) | | **[Superblocks](https://www.superblocks.com?utm_source=chatgpt.com)** | **Yes** | Explicitly says it will sign a BAA with HIPAA-covered customers. More low-code than pure no-code. [docs.superblocks.com](https://docs.superblocks.com/enterprise/security/hipaa?utm_source=chatgpt.com) | | **[WeWeb](https://www.weweb.io?utm_source=chatgpt.com)** | **Potentially / architecture-dependent** | Particularly attractive if you keep PHI in your own HIPAA-eligible backend and use WeWeb as the frontend. It supports self-hosting/export and emphasizes keeping data on your infrastructure. [www.weweb.io](https://www.weweb.io/blog/hipaa-compliant-app-builder-choosing-guide?utm_source=chatgpt.com) | | **[AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) + AWS** | **Yes, at AWS level** | AWS has a BAA and lists Amplify among HIPAA-eligible services. You still have to configure the architecture correctly. [aws.amazon.com](https://aws.amazon.com/tr/compliance/hipaa-eligible-services-reference/?utm_source=chatgpt.com) | | **[Mendix](https://www.mendix.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Enterprise low-code platform with HIPAA support; substantially heavier than typical startup no-code tools. | | **[ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Strong choice if you're already in ServiceNow; expensive/overkill for most small projects. [www.superblocks.com](https://www.superblocks.com/blog/ai-governance-features-low-code-app-platforms?utm_source=chatgpt.com) | ### Platforms I'd *not* assume are BAA-capable **Bubble:** despite being popular for healthcare apps, Bubble currently says its platform and internal processes **do not meet HIPAA requirements and it does not support HIPAA-compliant apps**. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Framer:** explicitly says it isn't designed for HIPAA and shouldn't be used to process or store PHI. [www.framer.com](https://www.framer.com/help/articles/framer-hipaa-compliance/?utm_source=chatgpt.com) ### My shortlist If you're trying to build an actual **HIPAA-regulated application without traditional coding**, I'd narrow it to: 1. **Airtable** — easiest if your application is essentially a database/workflow/portal. 2. **Superblocks** — strongest if you're building internal healthcare tools, dashboards, CRUD apps, or operational software. 3. **WeWeb + HIPAA-eligible backend** — probably the most interesting option for a polished customer/patient-facing web application. 4. **AWS + a no-code frontend** — best if you want maximum control and are willing to have a more technical architecture. One important distinction: **getting a BAA does not make your application HIPAA compliant by itself.** Your authentication, authorization, audit logging, integrations, backups, data flows, breach procedures, workforce policies, and overall risk analysis still matter. HHS specifically notes that compliance is a shared responsibility and that customers need to understand and configure their cloud environment appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, intake form, clinician dashboard, scheduling app, internal CRM, AI app), I can narrow this to the **3 best no-code stacks that will actually work for that use case**, including approximate pricing and whether the BAA is available on a normal plan or only enterprise.

Yes — **Knack offers a HIPAA-compliant option**, but there’s an important distinction: **the standard Knack platform is not automatically HIPAA-compliant.** For handling **PHI (protected health information)**, Knack says you need to use one of its **HIPAA plans** and have a **Business Associate Agreement (BAA)** in place. [www.knack.com](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) Key points: - **BAA:** Knack provides a BAA for customers on HIPAA plans. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com) - **Encryption:** Data is encrypted in transit and at rest. [www.knack.com](https://www.knack.com/health/security/?utm_source=chatgpt.com) - **Access controls:** Role-based permissions, 2FA, SSO options, and IP allowlisting are available. [www.knack.com](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) - **Auditability:** Knack provides record change logs/activity tracking. [www.knack.com](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) - **Third-party integrations:** If PHI leaves Knack and goes to another service, **that service also needs to be HIPAA-compliant and have an appropriate BAA with you**. Knack's BAA doesn't cover those third parties. [docs.knack.com](https://docs.knack.com/docs/flows-and-third-party-compliance?utm_source=chatgpt.com) - **Your responsibility:** Using a HIPAA-capable platform doesn't by itself make your application or organization HIPAA compliant. Your configuration, policies, access controls, and workflows matter. [www.knack.com](https://www.knack.com/health/how-hipaa-compliance-works/?utm_source=chatgpt.com) So if you're asking **“Can I build an app in Knack that stores patient information legally under HIPAA?”** — **yes, provided you're on the appropriate Knack HIPAA plan, execute the BAA, and configure/operate the application appropriately.** [Knack's HIPAA documentation](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) If you tell me **what kind of PHI you're planning to store in Knack** (e.g., patient intake, medical records, behavioral health notes, insurance information), I can also assess whether Knack is a *good* HIPAA choice for that particular use case. [Knack's HIPAA documentation](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com)

The short answer is: **it depends on which version of Claude you're using.** - **Consumer Claude (Free, Pro, Max):** **No.** You should **not** enter protected health information (PHI) into these plans because they are not covered by a HIPAA Business Associate Agreement (BAA). [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com)[support.claude.com](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans?utm_source=chatgpt.com) - **Claude Enterprise (HIPAA-ready):** **Yes, with conditions.** Anthropic offers a HIPAA-ready Enterprise configuration that includes a BAA and is designed for organizations that need to process PHI. However, the organization must explicitly enable the HIPAA-ready configuration and accept the BAA; a standard Enterprise deployment is not automatically covered. [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com)[support.claude.com](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans?utm_source=chatgpt.com) - **Claude API:** Anthropic also offers a HIPAA-ready API for eligible customers under a BAA, but only specific services and features are covered. [support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) A few important caveats: - **HIPAA compliance is shared responsibility.** Even if Anthropic provides a HIPAA-ready service and signs a BAA, your organization still needs appropriate administrative, technical, and physical safeguards (access controls, audit logging, policies, workforce training, etc.) to be HIPAA compliant. [support.claude.com](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans?utm_source=chatgpt.com)[support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) - **Not every Claude feature is covered.** Some products and features (such as certain beta features and tools like Claude Cowork) are explicitly excluded from BAA coverage. Anthropic publishes which services are eligible and which are not. [support.claude.com](https://support.claude.com/en/articles/13296973-hipaa-ready-enterprise-plans?utm_source=chatgpt.com)[support.claude.com](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers?utm_source=chatgpt.com) If you're evaluating Claude for a healthcare use case, I can also help determine whether your specific workflow (e.g., chart summarization, prior authorization, ambient documentation, patient messaging, or custom API integration) would fit within Anthropic's HIPAA-ready offering.

For a small healthcare practice, I’d treat this as **both a software-selection project and a vendor-risk/compliance project**. “HIPAA compliant” by itself is not a sufficient vendor qualification. ### 1. Define what the portal actually needs to do Before talking to vendors, write down your minimum requirements: - Patient registration/intake forms - Secure patient ↔ practice messaging - Appointment requests/reminders - Document upload/download - Lab results or clinical documents - E-signatures/consents - Billing/payment integration, if needed - Telehealth, if needed - Mobile-friendly patient experience - Integration with your EHR/practice-management system - Patient identity verification and account recovery - Staff roles and permissions - Audit logs Also decide whether you need a **standalone portal** or something tightly integrated with your existing EHR. For a small practice, an existing healthcare platform is often less risky and less expensive than commissioning a custom portal from scratch. ### 2. Make HIPAA contractual, not just marketing language Ask every vendor: > “Will you sign a Business Associate Agreement (BAA) with our practice covering all services that create, receive, maintain, or transmit PHI?” If the answer is **no, eliminate the vendor**. A BAA is an important part of the arrangement, but signing one doesn't magically make the system HIPAA compliant. Your practice still has its own HIPAA responsibilities, including risk analysis and appropriate safeguards. HHS specifically advises covered entities using cloud services involving ePHI to conduct a risk analysis and have appropriate agreements in place. [www.hhs.gov](https://www.hhs.gov/sites/default/files/june-2017-ocr-cyber-newsletter.pdf?utm_source=chatgpt.com) I'd have your healthcare attorney review the BAA and the main service agreement before signing. ### 3. Ask for evidence of security—not a “HIPAA badge” For each finalist, ask for: - SOC 2 Type II report, preferably current - Penetration-test summary and remediation process - Encryption at rest and in transit - MFA for staff and preferably patients - Role-based access controls - Detailed audit logging - Automatic session timeout - Backup and disaster-recovery procedures - Ransomware/business-continuity plan - Vulnerability and patch-management program - Incident/breach notification procedures - Data-retention and deletion policies - Subprocessor list - Data-center/cloud-provider information - Security policies and employee training - Cyber insurance Don't be satisfied with “we're HIPAA certified.” HIPAA doesn't provide a simple government certification that makes a vendor safe. What matters is whether the vendor's actual technical, administrative, and contractual controls appropriately address the risks. ONC's guidance emphasizes that healthcare organizations need to consider security across their various systems and technologies, not merely the EHR itself. [healthit.gov](https://healthit.gov/privacy-security/hipaa-basics/hipaa-providers/?utm_source=chatgpt.com) ### 4. Pay particular attention to integrations This is one of the biggest places a seemingly good portal can become a bad investment. Ask: - Which EHRs do you integrate with today? - Is the integration real-time? - What data can flow in each direction? - Do you use FHIR APIs? - Who pays for the integration? - Are there per-transaction/API fees? - What happens if the EHR changes its API? - Can we export all our data if we leave? - Can patients access their information through appropriate APIs? Interoperability is increasingly important. ONC's current materials emphasize APIs, standards, and patient access to health information; the USCDI standard also continues to evolve, with **USCDI v7 released July 23, 2026**. [healthit.gov](https://healthit.gov/patient-access-to-health-records/developers/?utm_source=chatgpt.com) If the vendor claims ONC certification, verify exactly **what product/module is certified and for which criteria** rather than accepting the claim at face value. ONC maintains the Certified Health IT Product List for this purpose. [healthit.gov](https://healthit.gov/certification-health-it/?utm_source=chatgpt.com) ### 5. Evaluate the vendor's business, not just its software For a small practice, vendor stability matters enormously. Ask: - How many healthcare customers do you have? - How many are practices approximately our size? - How long have you been operating? - Who owns the company? - What's your average customer retention? - What's your support response time? - Is support 24/7? - Who will be our implementation contact? - What happens if you are acquired? - What happens if you shut down? - How do we retrieve our data? I'd specifically ask for **three references from practices similar to yours**, not references from huge hospital systems. ### 6. Understand the total cost Don't compare vendors based on the monthly subscription alone. Build a five-year cost model containing: | Cost | Vendor A | Vendor B | Vendor C | |---|---:|---:|---:| | Setup/implementation | | | | | Monthly subscription | | | | | Per-provider fees | | | | | Per-patient fees | | | | | EHR integration | | | | | API fees | | | | | Messaging/SMS | | | | | Support | | | | | Data migration | | | | | Training | | | | | Customization | | | | | Exit/data-export fees | | | | | **5-year total** | | | | The last two categories are particularly easy to overlook. ### 7. Test the patient experience yourself Have the vendor give you a sandbox/demo account. Don't just watch their salesperson demonstrate it. Actually perform the workflows: **New patient** → receives invitation → creates account → verifies identity → completes intake → signs consent → uploads insurance/document → sends secure message → receives response. Then test the staff side: **Staff** → receives message → sees patient identity → assigns appropriate permissions → responds → documents the interaction → audits who accessed the record. A technically secure portal that patients hate using can be a failure for a small practice. ONC likewise notes that simply making a portal available doesn't ensure patients will use it; usability and integration into clinical workflows matter. [healthit.gov](https://healthit.gov/resources/how-optimize-patient-portals-patient-engagement-and-meet-meaningful-use-requirements/?utm_source=chatgpt.com) ### 8. Use a weighted scorecard I'd score finalists roughly like this: | Category | Weight | |---|---:| | Security/HIPAA controls | **25%** | | EHR/integration capability | **20%** | | Patient usability | **15%** | | Staff workflow | **10%** | | Vendor/support quality | **10%** | | Reliability/business continuity | **5%** | | Contract/BAA/data ownership | **10%** | | Total cost | **5%** | I'd make **security and contractual requirements pass/fail**, rather than allowing a cheap vendor to compensate for poor security with a high overall score. ### 9. Red flags that should make you walk away Be especially cautious if a vendor: - Won't sign a BAA - Can't explain where PHI is stored - Won't identify subprocessors - Has no meaningful audit logging - Can't explain incident response - Says “HIPAA compliant” but won't provide security documentation - Won't permit a security review - Has no clear data-export mechanism - Charges an enormous fee to retrieve your own data - Uses shared staff accounts - Doesn't support MFA - Has vague answers about backups - Can't explain how integrations are secured - Pressures you to sign before legal/security review ### 10. For a small practice, I'd strongly consider **buy vs. build** If by “vendor to build” you mean hiring a software-development firm to create a custom portal, I'd first ask whether you truly need custom software. Building your own patient portal means **you become responsible for operating and maintaining a healthcare application**, including security, updates, vulnerability management, incident response, backups, access controls, integrations, and ongoing compliance work. HHS/ONC guidance makes clear that healthcare organizations need an ongoing security-management process rather than a one-time compliance exercise. [healthit.gov](https://healthit.gov/patient-access-to-health-records/developers/?utm_source=chatgpt.com)[healthit.gov](https://healthit.gov/privacy-security/hipaa-basics/hipaa-providers/?utm_source=chatgpt.com) For most small practices, I'd investigate established healthcare platforms first and only pursue custom development if you have requirements they genuinely cannot satisfy. ### My recommended selection process **Shortlist 5 → security screen 3 → demos 3 → technical/security due diligence 2 → reference checks 2 → negotiate 1.** And before signing, have your **healthcare attorney and someone competent in healthcare cybersecurity** review the BAA, security documentation, data ownership/exit terms, and implementation architecture. If you tell me **what type of practice you have, approximately how many providers/patients, what EHR you're using, and the portal features you need**, I can turn this into a **vendor RFP/questionnaire and scoring matrix** you can send to 5–10 vendors. | Cost | Vendor A | Vendor B | Vendor C | |---|---:|---:|---:| | Setup/implementation | | | | | Monthly subscription | | | | | Per-provider fees | | | | | Per-patient fees | | | | | EHR integration | | | | | API fees | | | | | Messaging/SMS | | | | | Support | | | | | Data migration | | | | | Training | | | | | Customization | | | | | Exit/data-export fees | | | | | **5-year total** | | | | The last two categories are particularly easy to overlook. ### 7. Test the patient experience yourself Have the vendor give you a sandbox/demo account. Don't just watch their salesperson demonstrate it. Actually perform the workflows: **New patient** → receives invitation → creates account → verifies identity → completes intake → signs consent → uploads insurance/document → sends secure message → receives response. Then test the staff side: **Staff** → receives message → sees patient identity → assigns appropriate permissions → responds → documents the interaction → audits who accessed the record. A technically secure portal that patients hate using can be a failure for a small practice. ONC likewise notes that simply making a portal available doesn't ensure patients will use it; usability and integration into clinical workflows matter. [healthit.gov](https://healthit.gov/resources/how-optimize-patient-portals-patient-engagement-and-meet-meaningful-use-requirements/?utm_source=chatgpt.com) ### 8. Use a weighted scorecard I'd score finalists roughly like this: | Category | Weight | |---|---:| | Security/HIPAA controls | **25%** | | EHR/integration capability | **20%** | | Patient usability | **15%** | | Staff workflow | **10%** | | Vendor/support quality | **10%** | | Reliability/business continuity | **5%** | | Contract/BAA/data ownership | **10%** | | Total cost | **5%** | I'd make **security and contractual requirements pass/fail**, rather than allowing a cheap vendor to compensate for poor security with a high overall score. ### 9. Red flags that should make you walk away Be especially cautious if a vendor: - Won't sign a BAA - Can't explain where PHI is stored - Won't identify subprocessors - Has no meaningful audit logging - Can't explain incident response - Says “HIPAA compliant” but won't provide security documentation - Won't permit a security review - Has no clear data-export mechanism - Charges an enormous fee to retrieve your own data - Uses shared staff accounts - Doesn't support MFA - Has vague answers about backups - Can't explain how integrations are secured - Pressures you to sign before legal/security review ### 10. For a small practice, I'd strongly consider **buy vs. build** If by “vendor to build” you mean hiring a software-development firm to create a custom portal, I'd first ask whether you truly need custom software. Building your own patient portal means **you become responsible for operating and maintaining a healthcare application**, including security, updates, vulnerability management, incident response, backups, access controls, integrations, and ongoing compliance work. HHS/ONC guidance makes clear that healthcare organizations need an ongoing security-management process rather than a one-time compliance exercise. [healthit.gov](https://healthit.gov/patient-access-to-health-records/developers/?utm_source=chatgpt.com)[healthit.gov](https://healthit.gov/privacy-security/hipaa-basics/hipaa-providers/?utm_source=chatgpt.com) For most small practices, I'd investigate established healthcare platforms first and only pursue custom development if you have requirements they genuinely cannot satisfy. ### My recommended selection process **Shortlist 5 → security screen 3 → demos 3 → technical/security due diligence 2 → reference checks 2 → negotiate 1.** And before signing, have your **healthcare attorney and someone competent in healthcare cybersecurity** review the BAA, security documentation, data ownership/exit terms, and implementation architecture. If you tell me **what type of practice you have, approximately how many providers/patients, what EHR you're using, and the portal features you need**, I can turn this into a **vendor RFP/questionnaire and scoring matrix** you can send to 5–10 vendors.

For a digital-health startup, I’d narrow this to **five managed platforms**. The important caveat is that “turnkey” rarely means one SKU does everything: the strongest architectures pair a managed FHIR/interoperability service with a managed analytics/lakehouse layer and the provider’s native security/governance controls. ### Shortlist | Provider | Deployment model | PHI / compliance evidence | De-identification | FHIR + daily sync | Rough monthly run cost* | |---|---|---|---|---|---:| | **[Microsoft Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services/?utm_source=chatgpt.com)** | **Cloud-native** | HIPAA BAA included in Microsoft Product Terms; Azure maintains SOC 2 evidence. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us?utm_source=chatgpt.com) | **Excellent** — native ML de-identification can tag/redact/surrogate 27 PHI entities, including HIPAA's 18 identifiers. [learn.microsoft.com](https://learn.microsoft.com/th-th/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) | Managed FHIR, SMART on FHIR, RBAC, audit logs, export to analytics. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com) | **~$1.5k–$3.5k** | | **[Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com) + BigQuery** | **Cloud-native** | Google Cloud BAA covers Cloud Healthcare API; SOC 2 Type II reports available. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?hl=en&utm_source=chatgpt.com) | **Excellent** — native inspection, redaction/replacement/hashing and structured FHIR de-identification. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/healthcare-api/pricing?utm_source=chatgpt.com) | Managed FHIR/HL7v2/DICOM, BigQuery analytics, IAM, audit/access tooling. [docs.cloud.google.com](https://docs.cloud.google.com/healthcare-api/docs/introduction?authuser=1&utm_source=chatgpt.com) | **~$1.5k–$4k** | | **[AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com) + S3/Athena** | **Cloud-native** | HIPAA-eligible; AWS BAA required; AWS provides SOC reports through Artifact. [aws.amazon.com](https://aws.amazon.com/healthlake/faqs/?utm_source=chatgpt.com)[docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com) | **Good, but less turnkey** — native medical NLP extracts PHI; true de-ID generally requires an additional redaction/de-identification step. | Very strong: managed FHIR R4, SMART on FHIR, bulk export, subscriptions, zero-ETL to Iceberg/Athena. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com)[aws.amazon.com](https://aws.amazon.com/healthlake/pricing//?utm_source=chatgpt.com) | **~$1.3k–$3k** | | **[Snowflake](https://www.snowflake.com/?utm_source=chatgpt.com) Business Critical** | **Cloud-native / multi-cloud** | Business Critical supports PHI/HIPAA with signed BAA; SOC 2 Type II. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/intro-editions?utm_source=chatgpt.com) | **Good** — dynamic masking/tokenization natively; more sophisticated clinical-text de-ID typically uses Snowpark/containerized models. A healthcare customer has demonstrated 100M+ records redacted in <30 min. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/security-column-intro?wtime=%7Bseek_to_second_number%7D&utm_source=chatgpt.com) | **Not FHIR-native**; pair with Redox, cloud FHIR service, or an ingestion product. | **~$2.5k–$6k** | | **[Databricks](https://www.databricks.com/?utm_source=chatgpt.com) Lakehouse** | **Cloud-native / multi-cloud; hybrid possible** | Databricks publishes a SOC 2 Type II + HIPAA report available from its account team. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/security-column-intro?wtime=%7Bseek_to_second_number%7D&utm_source=chatgpt.com)[www.databricks.com](https://www.databricks.com/trust/compliance/hipaa?utm_source=chatgpt.com)[www.databricks.com](https://www.databricks.com/dataaisummit/session/agentic-phi-de-identification-across-multimodal-healthcare-data?utm_source=chatgpt.com) | **Very good**, particularly with Unity Catalog classification plus John Snow Labs/Spark NLP or Databricks de-ID workflows. [www.databricks.com](https://www.databricks.com/dataaisummit/session/agentic-phi-de-identification-across-multimodal-healthcare-data?utm_source=chatgpt.com) | Excellent analytics/ETL, but FHIR ingestion is normally via connectors/partners rather than native FHIR persistence. | **~$3k–$8k** | \*Estimates assume ~2 TB persistent data, moderate analytics, one daily FHIR synchronization cycle, development/staging included lightly, and no unusually high query/egress volume. They are **infrastructure estimates, not vendor quotes**; enterprise support, implementation, EHR connectivity and minimum commitments can materially change the number. ### My ranking for your requirements **1. Azure Health Data Services — best overall turnkey fit.** This is the closest match to your exact checklist. You get a managed FHIR service, Entra RBAC, audit logging, encryption at rest, HIPAA coverage, and—importantly—an actual managed de-identification service rather than having to assemble one yourself. Azure's de-ID service can operate synchronously or asynchronously against bulk data and is designed around HIPAA PHI identifiers. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com)[learn.microsoft.com](https://learn.microsoft.com/th-th/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) **2. Google Cloud Healthcare API + BigQuery — best analytics-oriented alternative.** Google is particularly attractive if your end state is population analytics/ML in BigQuery. The Healthcare API is fully managed and FHIR-native, while de-identification is a first-class billed operation rather than something you have to build. Google explicitly lists Cloud Healthcare as BAA-covered and within its SOC 2 scope. [docs.cloud.google.com](https://docs.cloud.google.com/healthcare-api/docs/introduction?authuser=1&utm_source=chatgpt.com) **3. AWS HealthLake + S3/Athena — best AWS-native option.** HealthLake has unusually attractive FHIR economics: the current price is **$0.27/hour per datastore + $0.37/GB/month above the first 10 GB** for Advanced, and FHIR-to-analytics export/transformation is **$0.19/GB**. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com)[aws.amazon.com](https://aws.amazon.com/healthlake/pricing//?utm_source=chatgpt.com) At 2 TB, the core HealthLake storage component alone is roughly **$950/month** before analytics, ingestion and networking. Customer-managed KMS keys and CloudTrail are supported. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/encryption-at-rest.html?utm_source=chatgpt.com) The weakness versus Azure/GCP is de-identification: HealthLake's integrated NLP identifies/extracts PHI, but you'll generally add another AWS service or pipeline stage to actually transform/remove identifiers. **4. Snowflake — best if analytics is the center of gravity.** Snowflake is compelling if you already have data engineering/BI around SQL and want the analytics layer to be the strategic system of record. Its Business Critical tier is specifically intended for PHI/HIPAA workloads and requires a BAA; SOC 2 Type II is documented. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/intro-editions?utm_source=chatgpt.com) It is less turnkey for the **FHIR ingestion** portion, so I'd normally pair it with Redox or one of the cloud FHIR services. **5. Databricks — best for sophisticated ML/data science.** Databricks becomes attractive when the analytics layer includes substantial ML, NLP, feature engineering and multimodal data. It has HIPAA/SOC 2 Type II evidence and increasingly sophisticated governance/classification tooling. [www.databricks.com](https://www.databricks.com/trust/compliance/hipaa?utm_source=chatgpt.com) But it's more of a **data/AI platform than a turnkey healthcare integration platform**, so expect more engineering than with Azure or GCP. ### One architectural option I'd seriously consider If **daily FHIR synchronization** is the hard part rather than merely storing FHIR, use **[Redox](https://redoxengine.com/?utm_source=chatgpt.com) as the managed interoperability layer** and put the analytical platform behind it. Redox supports FHIR, HL7v2, X12, CDA, DICOM and other formats, and can translate/normalize EHR data directly into AWS HealthLake, Snowflake, Databricks, Google Healthcare API or Azure Health Data Services. It maintains SOC 2 Type 2 and HITRUST certifications across its cloud environments. [docs.redoxengine.com](https://docs.redoxengine.com/basics/connecting-to-the-cloud-with-redox/?utm_source=chatgpt.com) That gives you: **EHRs → Redox → managed FHIR/landing zone → automated de-ID → analytics lakehouse → BI/ML** For a startup, I'd favor **Azure Health Data Services** if minimizing engineering/compliance work is the priority, or **Google Healthcare API + BigQuery** if analytics/ML is the priority. One procurement caveat: **a vendor having a BAA/HIPAA eligibility does not make your application automatically HIPAA-compliant**. You still need to configure IAM/RBAC, logging, key management, retention, minimum-necessary access, de-ID policy and incident controls correctly. Google explicitly describes this as shared responsibility. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa?authuser=19&utm_source=chatgpt.com) If you give me your approximate **FHIR volume per day (e.g. 10 GB/day vs. 100 GB/day), number of EHR connections, and analytics/query intensity**, I can turn these ranges into a more defensible **2-year TCO comparison**, including ingestion, storage, compute, de-ID, egress, BAA/compliance tooling and likely implementation effort. [Microsoft Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services/?utm_source=chatgpt.com) [Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com) [AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com) [Snowflake](https://www.snowflake.com/?utm_source=chatgpt.com) [Databricks](https://www.databricks.com/?utm_source=chatgpt.com) [Redox](https://redoxengine.com/?utm_source=chatgpt.com) | Provider | Deployment model | PHI / compliance evidence | De-identification | FHIR + daily sync | Rough monthly run cost* | |---|---|---|---|---|---:| | **[Microsoft Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services/?utm_source=chatgpt.com)** | **Cloud-native** | HIPAA BAA included in Microsoft Product Terms; Azure maintains SOC 2 evidence. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-hipaa-us?utm_source=chatgpt.com) | **Excellent** — native ML de-identification can tag/redact/surrogate 27 PHI entities, including HIPAA's 18 identifiers. [learn.microsoft.com](https://learn.microsoft.com/th-th/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) | Managed FHIR, SMART on FHIR, RBAC, audit logs, export to analytics. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com) | **~$1.5k–$3.5k** | | **[Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com) + BigQuery** | **Cloud-native** | Google Cloud BAA covers Cloud Healthcare API; SOC 2 Type II reports available. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?hl=en&utm_source=chatgpt.com) | **Excellent** — native inspection, redaction/replacement/hashing and structured FHIR de-identification. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/healthcare-api/pricing?utm_source=chatgpt.com) | Managed FHIR/HL7v2/DICOM, BigQuery analytics, IAM, audit/access tooling. [docs.cloud.google.com](https://docs.cloud.google.com/healthcare-api/docs/introduction?authuser=1&utm_source=chatgpt.com) | **~$1.5k–$4k** | | **[AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com) + S3/Athena** | **Cloud-native** | HIPAA-eligible; AWS BAA required; AWS provides SOC reports through Artifact. [aws.amazon.com](https://aws.amazon.com/healthlake/faqs/?utm_source=chatgpt.com)[docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com) | **Good, but less turnkey** — native medical NLP extracts PHI; true de-ID generally requires an additional redaction/de-identification step. | Very strong: managed FHIR R4, SMART on FHIR, bulk export, subscriptions, zero-ETL to Iceberg/Athena. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com)[aws.amazon.com](https://aws.amazon.com/healthlake/pricing//?utm_source=chatgpt.com) | **~$1.3k–$3k** | | **[Snowflake](https://www.snowflake.com/?utm_source=chatgpt.com) Business Critical** | **Cloud-native / multi-cloud** | Business Critical supports PHI/HIPAA with signed BAA; SOC 2 Type II. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/intro-editions?utm_source=chatgpt.com) | **Good** — dynamic masking/tokenization natively; more sophisticated clinical-text de-ID typically uses Snowpark/containerized models. A healthcare customer has demonstrated 100M+ records redacted in <30 min. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/security-column-intro?wtime=%7Bseek_to_second_number%7D&utm_source=chatgpt.com) | **Not FHIR-native**; pair with Redox, cloud FHIR service, or an ingestion product. | **~$2.5k–$6k** | | **[Databricks](https://www.databricks.com/?utm_source=chatgpt.com) Lakehouse** | **Cloud-native / multi-cloud; hybrid possible** | Databricks publishes a SOC 2 Type II + HIPAA report available from its account team. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/security-column-intro?wtime=%7Bseek_to_second_number%7D&utm_source=chatgpt.com)[www.databricks.com](https://www.databricks.com/trust/compliance/hipaa?utm_source=chatgpt.com)[www.databricks.com](https://www.databricks.com/dataaisummit/session/agentic-phi-de-identification-across-multimodal-healthcare-data?utm_source=chatgpt.com) | **Very good**, particularly with Unity Catalog classification plus John Snow Labs/Spark NLP or Databricks de-ID workflows. [www.databricks.com](https://www.databricks.com/dataaisummit/session/agentic-phi-de-identification-across-multimodal-healthcare-data?utm_source=chatgpt.com) | Excellent analytics/ETL, but FHIR ingestion is normally via connectors/partners rather than native FHIR persistence. | **~$3k–$8k** | \*Estimates assume ~2 TB persistent data, moderate analytics, one daily FHIR synchronization cycle, development/staging included lightly, and no unusually high query/egress volume. They are **infrastructure estimates, not vendor quotes**; enterprise support, implementation, EHR connectivity and minimum commitments can materially change the number. ### My ranking for your requirements **1. Azure Health Data Services — best overall turnkey fit.** This is the closest match to your exact checklist. You get a managed FHIR service, Entra RBAC, audit logging, encryption at rest, HIPAA coverage, and—importantly—an actual managed de-identification service rather than having to assemble one yourself. Azure's de-ID service can operate synchronously or asynchronously against bulk data and is designed around HIPAA PHI identifiers. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/fhir/overview?utm_source=chatgpt.com)[learn.microsoft.com](https://learn.microsoft.com/th-th/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) **2. Google Cloud Healthcare API + BigQuery — best analytics-oriented alternative.** Google is particularly attractive if your end state is population analytics/ML in BigQuery. The Healthcare API is fully managed and FHIR-native, while de-identification is a first-class billed operation rather than something you have to build. Google explicitly lists Cloud Healthcare as BAA-covered and within its SOC 2 scope. [docs.cloud.google.com](https://docs.cloud.google.com/healthcare-api/docs/introduction?authuser=1&utm_source=chatgpt.com) **3. AWS HealthLake + S3/Athena — best AWS-native option.** HealthLake has unusually attractive FHIR economics: the current price is **$0.27/hour per datastore + $0.37/GB/month above the first 10 GB** for Advanced, and FHIR-to-analytics export/transformation is **$0.19/GB**. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/reference-industry-ehrs.html?utm_source=chatgpt.com)[aws.amazon.com](https://aws.amazon.com/healthlake/pricing//?utm_source=chatgpt.com) At 2 TB, the core HealthLake storage component alone is roughly **$950/month** before analytics, ingestion and networking. Customer-managed KMS keys and CloudTrail are supported. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/encryption-at-rest.html?utm_source=chatgpt.com) The weakness versus Azure/GCP is de-identification: HealthLake's integrated NLP identifies/extracts PHI, but you'll generally add another AWS service or pipeline stage to actually transform/remove identifiers. **4. Snowflake — best if analytics is the center of gravity.** Snowflake is compelling if you already have data engineering/BI around SQL and want the analytics layer to be the strategic system of record. Its Business Critical tier is specifically intended for PHI/HIPAA workloads and requires a BAA; SOC 2 Type II is documented. [docs.snowflake.com](https://docs.snowflake.com/en/user-guide/intro-editions?utm_source=chatgpt.com) It is less turnkey for the **FHIR ingestion** portion, so I'd normally pair it with Redox or one of the cloud FHIR services. **5. Databricks — best for sophisticated ML/data science.** Databricks becomes attractive when the analytics layer includes substantial ML, NLP, feature engineering and multimodal data. It has HIPAA/SOC 2 Type II evidence and increasingly sophisticated governance/classification tooling. [www.databricks.com](https://www.databricks.com/trust/compliance/hipaa?utm_source=chatgpt.com) But it's more of a **data/AI platform than a turnkey healthcare integration platform**, so expect more engineering than with Azure or GCP. ### One architectural option I'd seriously consider If **daily FHIR synchronization** is the hard part rather than merely storing FHIR, use **[Redox](https://redoxengine.com/?utm_source=chatgpt.com) as the managed interoperability layer** and put the analytical platform behind it. Redox supports FHIR, HL7v2, X12, CDA, DICOM and other formats, and can translate/normalize EHR data directly into AWS HealthLake, Snowflake, Databricks, Google Healthcare API or Azure Health Data Services. It maintains SOC 2 Type 2 and HITRUST certifications across its cloud environments. [docs.redoxengine.com](https://docs.redoxengine.com/basics/connecting-to-the-cloud-with-redox/?utm_source=chatgpt.com) That gives you: **EHRs → Redox → managed FHIR/landing zone → automated de-ID → analytics lakehouse → BI/ML** For a startup, I'd favor **Azure Health Data Services** if minimizing engineering/compliance work is the priority, or **Google Healthcare API + BigQuery** if analytics/ML is the priority. One procurement caveat: **a vendor having a BAA/HIPAA eligibility does not make your application automatically HIPAA-compliant**. You still need to configure IAM/RBAC, logging, key management, retention, minimum-necessary access, de-ID policy and incident controls correctly. Google explicitly describes this as shared responsibility. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa?authuser=19&utm_source=chatgpt.com) If you give me your approximate **FHIR volume per day (e.g. 10 GB/day vs. 100 GB/day), number of EHR connections, and analytics/query intensity**, I can turn these ranges into a more defensible **2-year TCO comparison**, including ingestion, storage, compute, de-ID, egress, BAA/compliance tooling and likely implementation effort.

Yes. If you mean **no-code/low-code platforms that will actually execute a Business Associate Agreement (BAA)** and can therefore be used as part of an application that handles PHI, the strongest options I’d look at in 2026 are: | Platform | BAA? | Best for | My take | |---|---|---|---| | **Caspio** | ✅ Yes | Database-backed apps, portals, workflows | **Best general-purpose choice** | | **Knack Health** | ✅ Yes | Healthcare apps, databases, portals | **Best healthcare-focused choice** | | **Formstack** | ✅ Yes | Forms, intake, documents, e-signatures | **Best for forms/workflows** | | **Blaze** | ✅ Yes | Custom no-code healthcare/business apps | Worth evaluating | | **Microsoft Power Apps** | ✅ Yes* | Enterprise apps, especially Microsoft shops | Strong if you're already in Microsoft | | **Airtable** | ✅ Yes* | Lightweight databases/internal apps | Useful, but verify the exact HIPAA tier/configuration | ### 1. Caspio — probably my first choice Caspio explicitly offers a **HIPAA-Compliant Edition with a signed BAA**, encryption, access controls and audit logging. It is designed for building database-backed applications without coding, including patient portals, intake, scheduling and care-coordination applications. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) **Particularly good if:** you need a real relational database + custom UI + workflows rather than just a form. ### 2. Knack Health Knack now has a healthcare-specific platform with **BAA included on HIPAA plans**, encrypted storage/transfer, role-based permissions and record-change logs. It is explicitly designed for things like patient portals, intake, scheduling and internal healthcare applications. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com) This is especially interesting if your application is **healthcare-first rather than a generic business app**. ### 3. Formstack Formstack provides a **standard BAA** and has a dedicated healthcare configuration. It's particularly strong for patient intake, questionnaires, referrals, document generation, signatures and workflow automation. [www.formstack.com](https://www.formstack.com/solutions/hipaa-data-security?utm_source=chatgpt.com) [Formstack HIPAA data security](https://www.formstack.com/solutions/hipaa-data-security?utm_source=chatgpt.com) I'd choose Formstack over Caspio/Knack if the core product is essentially **"secure forms + documents + workflow."** ### 4. Blaze Blaze is another no-code application builder that advertises HIPAA support and BAA availability. It's more in the category of **building a complete custom application** rather than just collecting forms. [www.blaze.tech](https://www.blaze.tech/post/no-code-database?utm_source=chatgpt.com) I'd do more vendor diligence here than with Caspio or Formstack before putting production PHI on it. ### 5. Microsoft Power Apps Power Apps can be used in Microsoft's HIPAA-covered cloud environment, and Microsoft offers the contractual framework necessary for HIPAA use. It's particularly attractive if your organization already uses **Microsoft 365, Azure, Entra ID and Dataverse**. The catch is that "Microsoft is HIPAA compliant" doesn't automatically make **your Power App** compliant—you still have to configure permissions, logging, data flows, retention, etc. --- ### A few popular platforms I would **not** put PHI into This is where people get burned: - **Webflow** — does not sign a BAA. [www.loudface.co](https://www.loudface.co/blog/webflow-for-healthcare?utm_source=chatgpt.com) - **Retool Cloud** — Retool explicitly says it is **not a HIPAA Business Associate** and tells customers handling PHI to use its self-hosted deployment instead. [community.retool.com](https://community.retool.com/t/business-associate-agreement/28063?utm_source=chatgpt.com) - **Bubble** — don't assume its security/compliance certifications mean it will sign your BAA. - **Softr** — don't assume the fact that it can connect to healthcare databases makes Softr itself a BAA-covered processor. - **Glide** — generally not a BAA-backed PHI platform. - **Lovable / Bolt / Base44 and similar AI builders** — don't put production PHI in them unless you have an explicit, executed BAA covering the relevant service. [www.knack.com](https://www.knack.com/blog/no-code-prototype-hipaa-baa/?utm_source=chatgpt.com) ### The important distinction A platform being **"HIPAA compliant," "HIPAA-ready," SOC 2 certified, encrypted, or hosted on AWS** is *not* the same thing as the vendor signing a BAA with you. For a platform that will actually **create, receive, maintain, or transmit PHI**, I'd make the BAA the first gating question. If you tell me **what you're trying to build** (e.g. patient portal, medical intake app, CRM, internal dashboard, scheduling system, SaaS product for clinicians), I can narrow this down to the **3 best platforms and compare pricing, database capabilities, authentication, integrations, and BAA terms**. [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com) Caspio Knack Health Formstack Blaze | Platform | BAA? | Best for | My take | |---|---|---|---| | **Caspio** | ✅ Yes | Database-backed apps, portals, workflows | **Best general-purpose choice** | | **Knack Health** | ✅ Yes | Healthcare apps, databases, portals | **Best healthcare-focused choice** | | **Formstack** | ✅ Yes | Forms, intake, documents, e-signatures | **Best for forms/workflows** | | **Blaze** | ✅ Yes | Custom no-code healthcare/business apps | Worth evaluating | | **Microsoft Power Apps** | ✅ Yes* | Enterprise apps, especially Microsoft shops | Strong if you're already in Microsoft | | **Airtable** | ✅ Yes* | Lightweight databases/internal apps | Useful, but verify the exact HIPAA tier/configuration | ### 1. Caspio — probably my first choice Caspio explicitly offers a **HIPAA-Compliant Edition with a signed BAA**, encryption, access controls and audit logging. It is designed for building database-backed applications without coding, including patient portals, intake, scheduling and care-coordination applications. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) **Particularly good if:** you need a real relational database + custom UI + workflows rather than just a form. ### 2. Knack Health Knack now has a healthcare-specific platform with **BAA included on HIPAA plans**, encrypted storage/transfer, role-based permissions and record-change logs. It is explicitly designed for things like patient portals, intake, scheduling and internal healthcare applications. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com) This is especially interesting if your application is **healthcare-first rather than a generic business app**. ### 3. Formstack Formstack provides a **standard BAA** and has a dedicated healthcare configuration. It's particularly strong for patient intake, questionnaires, referrals, document generation, signatures and workflow automation. [www.formstack.com](https://www.formstack.com/solutions/hipaa-data-security?utm_source=chatgpt.com) [Formstack HIPAA data security](https://www.formstack.com/solutions/hipaa-data-security?utm_source=chatgpt.com) I'd choose Formstack over Caspio/Knack if the core product is essentially **"secure forms + documents + workflow."** ### 4. Blaze Blaze is another no-code application builder that advertises HIPAA support and BAA availability. It's more in the category of **building a complete custom application** rather than just collecting forms. [www.blaze.tech](https://www.blaze.tech/post/no-code-database?utm_source=chatgpt.com) I'd do more vendor diligence here than with Caspio or Formstack before putting production PHI on it. ### 5. Microsoft Power Apps Power Apps can be used in Microsoft's HIPAA-covered cloud environment, and Microsoft offers the contractual framework necessary for HIPAA use. It's particularly attractive if your organization already uses **Microsoft 365, Azure, Entra ID and Dataverse**. The catch is that "Microsoft is HIPAA compliant" doesn't automatically make **your Power App** compliant—you still have to configure permissions, logging, data flows, retention, etc. --- ### A few popular platforms I would **not** put PHI into This is where people get burned: - **Webflow** — does not sign a BAA. [www.loudface.co](https://www.loudface.co/blog/webflow-for-healthcare?utm_source=chatgpt.com) - **Retool Cloud** — Retool explicitly says it is **not a HIPAA Business Associate** and tells customers handling PHI to use its self-hosted deployment instead. [community.retool.com](https://community.retool.com/t/business-associate-agreement/28063?utm_source=chatgpt.com) - **Bubble** — don't assume its security/compliance certifications mean it will sign your BAA. - **Softr** — don't assume the fact that it can connect to healthcare databases makes Softr itself a BAA-covered processor. - **Glide** — generally not a BAA-backed PHI platform. - **Lovable / Bolt / Base44 and similar AI builders** — don't put production PHI in them unless you have an explicit, executed BAA covering the relevant service. [www.knack.com](https://www.knack.com/blog/no-code-prototype-hipaa-baa/?utm_source=chatgpt.com) ### The important distinction A platform being **"HIPAA compliant," "HIPAA-ready," SOC 2 certified, encrypted, or hosted on AWS** is *not* the same thing as the vendor signing a BAA with you. For a platform that will actually **create, receive, maintain, or transmit PHI**, I'd make the BAA the first gating question. If you tell me **what you're trying to build** (e.g. patient portal, medical intake app, CRM, internal dashboard, scheduling system, SaaS product for clinicians), I can narrow this down to the **3 best platforms and compare pricing, database capabilities, authentication, integrations, and BAA terms**. [Formstack HIPAA data security](https://www.formstack.com/solutions/hipaa-data-security?utm_source=chatgpt.com)

**It depends on which Gemini product you mean.** As of August 2026, you should not treat “Gemini” as universally HIPAA compliant. - **Gemini in Google Cloud / Vertex AI:** Google lists Gemini-related Google Cloud services within its HIPAA-covered environment. You need a **Business Associate Agreement (BAA)** with Google and must configure/use the covered services appropriately. HIPAA compliance remains a shared responsibility—you don't become compliant merely by using Google Cloud. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/security/compliance/hipaa?authuser=19&utm_source=chatgpt.com) - **Gemini in Google Workspace:** Google provides enterprise-grade protections for Workspace editions that include Gemini, and Gemini in Workspace is included among Google's generative-AI services covered by its relevant terms. However, you need to verify that your **specific Workspace edition and Gemini functionality** are covered by your organization's BAA. [cloud.google.com](https://cloud.google.com/terms/generative-ai-indemnified-services?utm_source=chatgpt.com)[support.google.com](https://support.google.com/gemini/answer/14620100?hl=en-CA&utm_source=chatgpt.com) - **Consumer Gemini app (personal Gemini):** **Don't assume it's appropriate for PHI.** Google's consumer Gemini Apps have a separate privacy framework, and that is not equivalent to having a HIPAA BAA for your healthcare use. [support.google.com](https://support.google.com/gemini/answer/13594961?hl=en&utm_source=chatgpt.com) - **Gemini in Chrome:** Google currently says this is **pending HIPAA** certification, so it should not be used for PHI under a HIPAA compliance program based on the current documentation. [cloud.google.com](https://cloud.google.com/terms/generative-ai-indemnified-services?utm_source=chatgpt.com)[support.google.com](https://support.google.com/gemini/answer/14620100?hl=en-CA&utm_source=chatgpt.com) One important nuance: **HIPAA doesn't actually certify AI products as “HIPAA compliant.”** HHS doesn't issue a HIPAA certification. What matters is whether the vendor will execute a BAA and whether the particular service/use case and your implementation satisfy HIPAA requirements. Google explicitly makes this distinction. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/security/compliance/hipaa?authuser=19&utm_source=chatgpt.com) If you're asking because you're considering **using Gemini to process patient information/PHI**, tell me **which Gemini product (Gemini app, Gemini for Workspace, Gemini API/Vertex AI, etc.)** and I can give you a precise yes/no assessment, including **whether a BAA is available and what configuration is required**.

Yes. **Caspio offers a HIPAA-compliant edition**, but there’s an important distinction: you generally need to use **Caspio’s HIPAA Edition** if you’re storing, processing, or transmitting PHI—not just a standard Caspio account. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) Caspio says its HIPAA Edition includes: - **Signed Business Associate Agreement (BAA)** with customers - **Dedicated HIPAA environment** - Encryption **at rest and in transit** - **Audit trails/logging** of data activity - Role-based access controls and authentication - Documented HIPAA policies and procedures - Annual independent auditing of the HIPAA controls [www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) Caspio currently lists the HIPAA Edition starting at **$800/month on a one-year term**, although your actual pricing can vary. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) ### One important caveat **“HIPAA-compliant platform” doesn't automatically make your application HIPAA compliant.** Your configuration, user permissions, workflows, integrations, policies, and handling of PHI still have to satisfy your organization's HIPAA obligations. Caspio itself notes that compliance depends on both the platform's controls **and how the application is configured**. [www.caspio.com](https://www.caspio.com/blog/hipaa-compliance-guide-no-code-applications/?utm_source=chatgpt.com) If you're considering Caspio for something specific—e.g. **patient records, a patient portal, intake forms, clinical data, or an internal healthcare database**—I can also break down **exactly what you would need to configure in Caspio to make that use case HIPAA-compliant**.

**Not yet — as of August 17, 2026, Bubble is not generally HIPAA-compliant.** Bubble says HIPAA compliance is **currently in progress** and is targeted for the **second half of 2026**. Bubble also says the HIPAA functionality will require a **dedicated/Enterprise plan**. [bubble.io](https://bubble.io/blog/april-2026-founder-ama/?utm_source=chatgpt.com) A few important distinctions: - **Bubble is SOC 2 Type II compliant** and has security features such as encryption, privacy rules, and security scanning, but SOC 2 does **not** equal HIPAA compliance. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) - HIPAA requires more than secure hosting. If Bubble is handling **PHI**, you'd generally need Bubble to take on the appropriate Business Associate obligations and execute a **BAA**, along with configuring your application and other services appropriately. - Bubble's current public DPA covers general data-protection laws, but that isn't a HIPAA BAA. [bubble.io](https://bubble.io/dpa?utm_source=chatgpt.com) - Bubble's current subprocessors list includes services such as AWS, Cloudflare, Google Cloud, OpenAI, and others, so a HIPAA architecture also has to account for **every service that touches PHI**, not just Bubble itself. [bubble.io](https://bubble.io/subprocessors?utm_source=chatgpt.com) ### If you're planning a healthcare app I **would not put real PHI into a standard Bubble application today** unless Bubble has specifically put you on its HIPAA-enabled offering and executed the necessary agreements. You *can*, however, potentially use Bubble for the **non-PHI portion of the application** while keeping PHI in a separately designed HIPAA-compliant backend/service. The exact architecture matters. If you tell me **what you're building in Bubble** (e.g., patient portal, telehealth, medical scheduling, clinician dashboard, AI healthcare app), I can tell you **what data you can safely keep in Bubble vs. what needs to stay outside it**, and suggest a HIPAA-compliant architecture.

Yes — **Airtable can be used for HIPAA-covered patient data, but only under specific conditions.** It is not accurate to say that every Airtable account or workspace is automatically HIPAA compliant. As of July 2026, Airtable states that organizations storing ePHI must: - Be on the **Enterprise Scale** plan. - Execute Airtable's **Health Information Exhibit**, which includes its **Business Associate Addendum (BAA)**. - Have HIPAA enabled for the relevant organization/workspaces. - Configure Airtable appropriately and maintain their own HIPAA safeguards. [support.airtable.com](https://support.airtable.com/understanding-hipaa-at-airtable?utm_source=chatgpt.com)[www.airtable.com](https://www.airtable.com/company/health-info-datasheet?utm_source=chatgpt.com) ### Important limitations A few things are particularly important if you're considering Airtable for patient records: - **Do not put PHI into a regular/free/Team/Business Airtable account** without the required HIPAA agreement and enablement. Airtable explicitly says customers may not store ePHI unless they are on Enterprise Scale and have executed the Health Information Exhibit. [support.airtable.com](https://support.airtable.com/understanding-hipaa-at-airtable?utm_source=chatgpt.com)[www.airtable.com](https://www.airtable.com/company/health-info-datasheet?utm_source=chatgpt.com) - **Airtable is not currently intended to be used as a patient portal.** [support.airtable.com](https://support.airtable.com/understanding-hipaa-at-airtable?utm_source=chatgpt.com)[www.airtable.com](https://www.airtable.com/company/health-info-datasheet?utm_source=chatgpt.com) - **Integrations are your responsibility.** If PHI leaves Airtable through an integration, you need to ensure the receiving system and integration are also HIPAA compliant and appropriately covered. [support.airtable.com](https://support.airtable.com/understanding-hipaa-at-airtable?utm_source=chatgpt.com)[www.airtable.com](https://www.airtable.com/company/health-info-datasheet?utm_source=chatgpt.com) - **Airtable AI requires additional attention.** Airtable allows AI with HIPAA-enabled environments under its Supplemental AI Terms for Health Information, but there are specific restrictions and responsibilities. [www.airtable.com](https://www.airtable.com/company/ai-terms-health-information?utm_source=chatgpt.com) - Airtable provides relevant security controls such as encryption, audit capabilities, SSO, and enterprise security features, but **HIPAA compliance is a shared responsibility** between Airtable and your organization. [support.airtable.com](https://support.airtable.com/understanding-hipaa-at-airtable?utm_source=chatgpt.com)[www.airtable.com](https://www.airtable.com/company/health-info-datasheet?utm_source=chatgpt.com) So, if your question is **"Can I build a patient-tracking system in Airtable containing names, diagnoses, appointments, insurance information, etc.?"** the answer is **potentially yes, but you'd need the Enterprise Scale + Health Information Exhibit/BAA arrangement and a properly configured workflow.** If you tell me **what patient data you want to store and what you're using Airtable for** (e.g., patient intake, referral tracking, case management, scheduling, clinical notes), I can tell you whether Airtable is a reasonable HIPAA-compliant architecture for that particular use case.

For a small healthcare practice, I’d choose the vendor as if you were buying a **security-critical healthcare system**, not just hiring a web-development shop. “HIPAA compliant” is not a product feature that a vendor can simply certify for you; HIPAA compliance depends on the entire system, configuration, contracts, policies, and how your practice uses it. HHS specifically says OCR does **not** certify or endorse particular technologies or products. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 1. Start with your requirements—not vendor pitches Define exactly what the portal needs to do: - Patient registration/intake and forms - Secure messaging - Appointment requests/scheduling - Document exchange - Lab/result delivery - Payments or billing - Telehealth, if applicable - Integration with your EHR/EMR - Staff/admin portal - Patient identity verification and password recovery - Audit trail - Data export and migration Also identify **what PHI the portal will create, receive, maintain, or transmit**. That determines which vendors and subcontractors become business associates. ### 2. Make a BAA a non-negotiable requirement If the vendor will handle ePHI on your behalf, you generally need a HIPAA-compliant **Business Associate Agreement (BAA)** with that vendor. HHS explicitly says this applies to cloud providers that create, receive, maintain, or transmit ePHI—even if the data is encrypted and the provider doesn't possess the decryption key. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Ask every candidate: > “Will you execute your BAA before we put any PHI into the system?” A vendor saying *“our platform is HIPAA compliant, so you don't need a BAA”* should be a major red flag if they are actually handling your PHI. Also ask who their **subcontractors/sub-processors** are and whether they will be covered appropriately. HHS's sample BAA provisions specifically address subcontractors that have access to PHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 3. Evaluate security architecture in detail Don't accept “bank-level security” or “HIPAA-ready” as an answer. Ask the vendor to explain: | Area | What I'd want to see | |---|---| | Encryption | Encryption in transit and at rest | | Authentication | MFA, strong password controls, secure account recovery | | Authorization | Role-based access; least privilege | | Audit logging | Who accessed/changed what, when, and from where | | Admin access | Strong controls around vendor personnel with production access | | Backups | Encrypted, tested, documented recovery | | Disaster recovery | RTO/RPO and recovery testing | | Vulnerability management | Patching, scanning, penetration testing | | Monitoring | Detection and response to suspicious activity | | Development | Secure SDLC, code review, dependency management | | Data isolation | Logical separation between practices/customers | | Data deletion | What happens when your contract ends | | Data export | Ability to retrieve your complete data | HHS emphasizes that risk analysis is foundational to selecting and implementing appropriate safeguards, and that security measures should be appropriate to the organization's size, infrastructure, costs, and risks. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Ask for evidence, not promises For your finalists, request: - SOC 2 Type II report, if available - Recent penetration-test summary - Security architecture/overview - Incident-response policy or summary - Business continuity/disaster-recovery documentation - Encryption details - List of subprocessors - Data-center/cloud-provider information - Uptime history/SLA - BAA - Cybersecurity insurance information - References from **small healthcare practices** You don't necessarily need every vendor to hand over its entire security program. But a vendor unwilling to provide *any* meaningful evidence should concern you. HHS notes that HIPAA doesn't automatically require a CSP to give customers security documentation or audit rights, but customers can negotiate additional assurances based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 5. Pay particular attention to the contract The BAA shouldn't be the only document you review. Your services agreement/SLA should address things like: - Uptime and support response times - Security responsibilities of each party - Breach/incident notification - Backup and disaster recovery - Data ownership - Data retention - Data return/export - Data destruction after termination - Vendor access to your data - Subcontractors - Termination rights - Liability/indemnification - Cyber insurance HHS specifically identifies availability, backup/recovery, data return, security responsibilities, and retention/disclosure restrictions as issues that can be addressed in an SLA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 6. Be especially careful if you're hiring a custom-development firm If you're **building a portal from scratch**, I'd put substantially more weight on the development team's security maturity than on their portfolio. Ask: 1. Who owns the source code? 2. Where is production hosted? 3. Which cloud services are being used? 4. Which of those providers will sign BAAs? 5. Who has production database access? 6. How is PHI prevented from appearing in developer/test environments? 7. Is PHI ever copied into local developer machines? 8. How are secrets/API keys managed? 9. What is the authentication architecture? 10. How are authorization rules tested? 11. What happens when an employee leaves? 12. Is there independent penetration testing before launch? 13. How are vulnerabilities reported and fixed? 14. What happens if the developer goes out of business? 15. Can another developer take over the system? I'd be particularly wary of a small development shop that says, essentially, **“We'll make the website HIPAA compliant.”** Building a secure healthcare application requires considerably more than adding HTTPS and a login page. ### 7. Score vendors instead of choosing by gut feeling I'd use a weighted scorecard something like: - **Security architecture & controls — 25%** - **HIPAA/BAA & compliance maturity — 20%** - **Healthcare experience — 15%** - **Functionality/workflow fit — 15%** - **EHR/integration capabilities — 10%** - **Reliability/support — 5%** - **Total cost of ownership — 5%** - **Vendor viability/data portability — 5%** Don't let a vendor win because it's $10,000 cheaper if its security evidence, contract, or exit strategy is substantially worse. ### 8. Run a realistic demo Don't let them give you a generic sales demo. Give each finalist the **same patient journey**: > New patient → creates account → completes intake → uploads ID/document → sends secure message → receives a document → staff member accesses it → another staff member with different permissions attempts access → patient closes account. Ask the vendor to demonstrate each step and show **what gets logged**. That exposes weaknesses in authentication, authorization, workflow, audit logging, patient experience, and staff administration much faster than a feature checklist. ### 9. Don't overlook the practice's responsibilities Even with an excellent vendor, your practice remains responsible for its own HIPAA compliance. For example, if the vendor contract says your practice controls certain authentication/security functions and your practice fails to configure them appropriately, that can matter in an OCR investigation. HHS explicitly emphasizes understanding which security responsibilities belong to the customer versus the cloud provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) I'd therefore budget for a **HIPAA/security risk assessment before launch**, rather than assuming the vendor's BAA makes the portal compliant. HHS provides a Security Risk Assessment resource specifically intended to help small and medium-sized practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### The biggest red flags I'd eliminate or seriously downgrade a vendor that: - Won't sign a BAA - Can't explain where PHI is stored - Can't identify its subprocessors - Has no meaningful audit logging - Doesn't support MFA - Gives developers unrestricted production access - Uses production PHI in development/testing - Can't explain backup/recovery - Has no documented incident-response process - Won't provide reasonable security evidence - Has vague data-deletion/export terms - Claims “HIPAA certification” as its primary security evidence - Is dramatically cheaper because security work is being treated as an afterthought **One final point:** don't make “HIPAA compliant” your primary vendor-selection criterion. Make **“Can this vendor demonstrate that the system, contracts, controls, and operating model appropriately address our identified risks?”** the criterion. That's much closer to how HHS frames the Security Rule. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you're actually evaluating vendors now, I can also give you a **one-page vendor RFP/questionnaire with ~30 questions and a scoring rubric** that you can send to prospective portal developers. | Area | What I'd want to see | |---|---| | Encryption | Encryption in transit and at rest | | Authentication | MFA, strong password controls, secure account recovery | | Authorization | Role-based access; least privilege | | Audit logging | Who accessed/changed what, when, and from where | | Admin access | Strong controls around vendor personnel with production access | | Backups | Encrypted, tested, documented recovery | | Disaster recovery | RTO/RPO and recovery testing | | Vulnerability management | Patching, scanning, penetration testing | | Monitoring | Detection and response to suspicious activity | | Development | Secure SDLC, code review, dependency management | | Data isolation | Logical separation between practices/customers | | Data deletion | What happens when your contract ends | | Data export | Ability to retrieve your complete data | HHS emphasizes that risk analysis is foundational to selecting and implementing appropriate safeguards, and that security measures should be appropriate to the organization's size, infrastructure, costs, and risks. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Ask for evidence, not promises For your finalists, request: - SOC 2 Type II report, if available - Recent penetration-test summary - Security architecture/overview - Incident-response policy or summary - Business continuity/disaster-recovery documentation - Encryption details - List of subprocessors - Data-center/cloud-provider information - Uptime history/SLA - BAA - Cybersecurity insurance information - References from **small healthcare practices** You don't necessarily need every vendor to hand over its entire security program. But a vendor unwilling to provide *any* meaningful evidence should concern you. HHS notes that HIPAA doesn't automatically require a CSP to give customers security documentation or audit rights, but customers can negotiate additional assurances based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 5. Pay particular attention to the contract The BAA shouldn't be the only document you review. Your services agreement/SLA should address things like: - Uptime and support response times - Security responsibilities of each party - Breach/incident notification - Backup and disaster recovery - Data ownership - Data retention - Data return/export - Data destruction after termination - Vendor access to your data - Subcontractors - Termination rights - Liability/indemnification - Cyber insurance HHS specifically identifies availability, backup/recovery, data return, security responsibilities, and retention/disclosure restrictions as issues that can be addressed in an SLA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 6. Be especially careful if you're hiring a custom-development firm If you're **building a portal from scratch**, I'd put substantially more weight on the development team's security maturity than on their portfolio. Ask: 1. Who owns the source code? 2. Where is production hosted? 3. Which cloud services are being used? 4. Which of those providers will sign BAAs? 5. Who has production database access? 6. How is PHI prevented from appearing in developer/test environments? 7. Is PHI ever copied into local developer machines? 8. How are secrets/API keys managed? 9. What is the authentication architecture? 10. How are authorization rules tested? 11. What happens when an employee leaves? 12. Is there independent penetration testing before launch? 13. How are vulnerabilities reported and fixed? 14. What happens if the developer goes out of business? 15. Can another developer take over the system? I'd be particularly wary of a small development shop that says, essentially, **“We'll make the website HIPAA compliant.”** Building a secure healthcare application requires considerably more than adding HTTPS and a login page. ### 7. Score vendors instead of choosing by gut feeling I'd use a weighted scorecard something like: - **Security architecture & controls — 25%** - **HIPAA/BAA & compliance maturity — 20%** - **Healthcare experience — 15%** - **Functionality/workflow fit — 15%** - **EHR/integration capabilities — 10%** - **Reliability/support — 5%** - **Total cost of ownership — 5%** - **Vendor viability/data portability — 5%** Don't let a vendor win because it's $10,000 cheaper if its security evidence, contract, or exit strategy is substantially worse. ### 8. Run a realistic demo Don't let them give you a generic sales demo. Give each finalist the **same patient journey**: > New patient → creates account → completes intake → uploads ID/document → sends secure message → receives a document → staff member accesses it → another staff member with different permissions attempts access → patient closes account. Ask the vendor to demonstrate each step and show **what gets logged**. That exposes weaknesses in authentication, authorization, workflow, audit logging, patient experience, and staff administration much faster than a feature checklist. ### 9. Don't overlook the practice's responsibilities Even with an excellent vendor, your practice remains responsible for its own HIPAA compliance. For example, if the vendor contract says your practice controls certain authentication/security functions and your practice fails to configure them appropriately, that can matter in an OCR investigation. HHS explicitly emphasizes understanding which security responsibilities belong to the customer versus the cloud provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) I'd therefore budget for a **HIPAA/security risk assessment before launch**, rather than assuming the vendor's BAA makes the portal compliant. HHS provides a Security Risk Assessment resource specifically intended to help small and medium-sized practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### The biggest red flags I'd eliminate or seriously downgrade a vendor that: - Won't sign a BAA - Can't explain where PHI is stored - Can't identify its subprocessors - Has no meaningful audit logging - Doesn't support MFA - Gives developers unrestricted production access - Uses production PHI in development/testing - Can't explain backup/recovery - Has no documented incident-response process - Won't provide reasonable security evidence - Has vague data-deletion/export terms - Claims “HIPAA certification” as its primary security evidence - Is dramatically cheaper because security work is being treated as an afterthought **One final point:** don't make “HIPAA compliant” your primary vendor-selection criterion. Make **“Can this vendor demonstrate that the system, contracts, controls, and operating model appropriately address our identified risks?”** the criterion. That's much closer to how HHS frames the Security Rule. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you're actually evaluating vendors now, I can also give you a **one-page vendor RFP/questionnaire with ~30 questions and a scoring rubric** that you can send to prospective portal developers.

Yes. If you mean **true no-code/low-code app builders that will actually execute a HIPAA Business Associate Agreement (BAA)**, there are several good options as of 2026. | Platform | BAA? | HIPAA availability | Best for | |---|---|---|---| | **Caspio** | ✅ Yes | Dedicated HIPAA Edition | Custom patient portals, databases, workflows | | **Knack Health** | ✅ Yes | HIPAA plans | Healthcare databases, portals, internal apps | | **Blaze** | ✅ Yes | Higher/enterprise tiers | Custom healthcare apps and portals | | **Microsoft Power Apps** | ✅ Yes, through Microsoft's HIPAA BAA | Eligible Microsoft cloud environments | Enterprise/internal apps | | **Airtable** | ✅ Yes | Higher-tier/enterprise arrangements | Lightweight databases and operational apps | | **Quickbase** | ✅ Yes | HIPAA-capable enterprise offering | Complex business workflows | | **Formstack** | ✅ Yes | Healthcare plans | Forms, intake, signatures, workflows | | **Jotform** | ✅ Yes | HIPAA-enabled plans | Patient intake/forms | | **Zapier** | ✅ Yes | HIPAA plan | Connecting BAA-covered systems | ### My top choices **1. Caspio — probably the strongest general-purpose choice.** Caspio has a dedicated HIPAA Edition with a **signed BAA, dedicated HIPAA environment, encryption, audit trails, role-based access, and unlimited users**. It's particularly good if you're building an actual application rather than just a form. [www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) **2. Knack Health — excellent for a database-centric healthcare app.** Knack now has a healthcare-specific product with a **signed BAA, encrypted storage, role-based permissions, and record-change logs**. This is attractive for patient/client databases, case management, intake, scheduling, and operational tools. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) **3. Microsoft Power Apps — best if you're already in Microsoft 365.** Microsoft explicitly lists Power Apps and Power Automate among its HIPAA in-scope cloud services. The important caveat is that **your Microsoft environment still has to be configured appropriately**; the BAA alone doesn't make an app HIPAA compliant. [learn.microsoft.com](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech?utm_source=chatgpt.com) **4. Formstack — particularly good for forms/intake.** Formstack provides a standard BAA and has a healthcare-specific configuration with encryption, permissions, audit logging, and field/folder security. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) ### A few important caveats A **BAA ≠ automatically HIPAA compliant**. HHS specifically says that a cloud provider handling ePHI needs a HIPAA-compliant BAA, but the covered entity also has to perform its own risk analysis and configure/use the service appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com) Also, don't just ask *"Is your platform HIPAA compliant?"* Ask: > **"Will you sign a BAA covering the specific product, plan, and services I'll use to store/process/transmit PHI?"** That's especially important with integrations. If your no-code app sends PHI to an email provider, analytics service, AI model, automation tool, etc., **those downstream vendors may need their own BAAs too**. If you're considering **Bubble, Glide, Softr, Retool, WeWeb, FlutterFlow, Lovable, or similar**, I can also give you a **2026 yes/no matrix of ~20 popular no-code platforms, including exactly which plans will sign a BAA and approximate pricing**. Caspio Knack Blaze Airtable Formstack Jotform Zapier Yes. If you mean **true no-code/low-code app builders that will actually execute a HIPAA Business Associate Agreement (BAA)**, there are several good options as of 2026. | Platform | BAA? | HIPAA availability | Best for | |---|---|---|---| | **Caspio** | ✅ Yes | Dedicated HIPAA Edition | Custom patient portals, databases, workflows | | **Knack Health** | ✅ Yes | HIPAA plans | Healthcare databases, portals, internal apps | | **Blaze** | ✅ Yes | Higher/enterprise tiers | Custom healthcare apps and portals | | **Microsoft Power Apps** | ✅ Yes, through Microsoft's HIPAA BAA | Eligible Microsoft cloud environments | Enterprise/internal apps | | **Airtable** | ✅ Yes | Higher-tier/enterprise arrangements | Lightweight databases and operational apps | | **Quickbase** | ✅ Yes | HIPAA-capable enterprise offering | Complex business workflows | | **Formstack** | ✅ Yes | Healthcare plans | Forms, intake, signatures, workflows | | **Jotform** | ✅ Yes | HIPAA-enabled plans | Patient intake/forms | | **Zapier** | ✅ Yes | HIPAA plan | Connecting BAA-covered systems | ### My top choices **1. Caspio — probably the strongest general-purpose choice.** Caspio has a dedicated HIPAA Edition with a **signed BAA, dedicated HIPAA environment, encryption, audit trails, role-based access, and unlimited users**. It's particularly good if you're building an actual application rather than just a form. [www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) **2. Knack Health — excellent for a database-centric healthcare app.** Knack now has a healthcare-specific product with a **signed BAA, encrypted storage, role-based permissions, and record-change logs**. This is attractive for patient/client databases, case management, intake, scheduling, and operational tools. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) **3. Microsoft Power Apps — best if you're already in Microsoft 365.** Microsoft explicitly lists Power Apps and Power Automate among its HIPAA in-scope cloud services. The important caveat is that **your Microsoft environment still has to be configured appropriately**; the BAA alone doesn't make an app HIPAA compliant. [learn.microsoft.com](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech?utm_source=chatgpt.com) **4. Formstack — particularly good for forms/intake.** Formstack provides a standard BAA and has a healthcare-specific configuration with encryption, permissions, audit logging, and field/folder security. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) ### A few important caveats A **BAA ≠ automatically HIPAA compliant**. HHS specifically says that a cloud provider handling ePHI needs a HIPAA-compliant BAA, but the covered entity also has to perform its own risk analysis and configure/use the service appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com) Also, don't just ask *"Is your platform HIPAA compliant?"* Ask: > **"Will you sign a BAA covering the specific product, plan, and services I'll use to store/process/transmit PHI?"** That's especially important with integrations. If your no-code app sends PHI to an email provider, analytics service, AI model, automation tool, etc., **those downstream vendors may need their own BAAs too**. If you're considering **Bubble, Glide, Softr, Retool, WeWeb, FlutterFlow, Lovable, or similar**, I can also give you a **2026 yes/no matrix of ~20 popular no-code platforms, including exactly which plans will sign a BAA and approximate pricing**.

For a 2 TB PHI workload with daily FHIR synchronization, I’d shortlist **AWS HealthLake, Google Cloud Healthcare API, Azure Health Data Services, Innovaccer, Health Catalyst, and Snowflake**. The first three are the strongest “build on a managed healthcare substrate” choices; Innovaccer/Health Catalyst are closer to turnkey healthcare analytics; Snowflake is excellent as an analytics layer but needs more assembly around FHIR/de-identification. **Important:** HIPAA itself does not issue a “HIPAA certification.” A BAA plus appropriately configured controls is the relevant evidence. AWS explicitly describes this as a shared-responsibility model. [aws.amazon.com](https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud/?utm_source=chatgpt.com) | Provider | Deployment | BAA / HIPAA / SOC 2 evidence | Required capabilities | Rough monthly run cost* | Fit | |---|---|---|---|---:|---| | **[AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com)** | Cloud-native AWS | HIPAA-eligible; AWS BAA; AWS SOC reports available through AWS Artifact. HealthLake encrypts stored content and requires TLS for connections. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/what-is.html?utm_source=chatgpt.com) | Native FHIR persistence/query; encryption; IAM/KMS; CloudTrail audit; integrate Comprehend Medical/Glue/S3 for de-ID and analytics | **~$600–$1,500/mo** | **Best infrastructure-first option** | | **[Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com)** | Cloud-native GCP | Healthcare API is covered by Google Cloud BAA; Google provides SOC 2 reports. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com) | FHIR R4; IAM; audit logging; encryption; native de-identification; BigQuery/Looker analytics; consent/access controls | **~$700–$2,000/mo** | **Best integrated FHIR + de-ID + analytics stack** | | **[Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services?utm_source=chatgpt.com)** | Cloud-native Azure | HIPAA/BAA-covered Azure services; Azure advertises 100+ compliance certifications. [azure.microsoft.com](https://azure.microsoft.com/en-us/products/health-data-services?utm_source=chatgpt.com) | Managed FHIR; audit logs; RBAC; encryption; native clinical-data de-identification; Synapse/Fabric/Power BI analytics | **~$700–$2,000/mo** | **Best if you're already Microsoft/Azure-oriented** | | **[Innovaccer Health Cloud](https://innovaccer.com/health-cloud?utm_source=chatgpt.com)** | Cloud-native, primarily managed SaaS/AWS | FHIR-enabled Data Activation Platform has HITRUST CSF certification and operates in AWS; security operations include continuous monitoring. [innovaccer.com](https://innovaccer.com/security?utm_source=chatgpt.com) | Healthcare data ingestion/harmonization; FHIR; identity resolution; analytics; governance/access controls; managed services | **~$5k–$20k+/mo**† | **Strongest turnkey healthcare-data option** | | **[Health Catalyst Ignite](https://healthcatalyst.com/products/health-catalyst-ignite-data-and-analytics?utm_source=chatgpt.com)** | Managed cloud / hybrid enterprise | Health Catalyst states HIPAA adherence, SOC 2 Type II coverage for Ignite/Data & Analytics, and HITRUST certifications for applicable platforms. [www.healthcatalyst.com](https://www.healthcatalyst.com/information-security?utm_source=chatgpt.com) | Healthcare-specific data model; clinical/claims/financial integration; analytics; managed implementation/services | **~$10k–$30k+/mo**† | **Best turnkey analytics + services** | | **[Snowflake Healthcare](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com)** | Cloud-native, multi-cloud | HIPAA/HITRUST support; SOC 2 Type II; automatic encryption; granular governance. [www.snowflake.com](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com) | Excellent analytics/governance; RBAC; masking; audit; Snowpipe FHIR ingestion via surrounding tooling; de-ID generally requires additional implementation | **~$1k–$4k/mo**‡ | **Best analytics layer, least turnkey FHIR** | \* These are **budgetary estimates, not vendor quotes**. I assumed ~2 TB persistently stored, daily incremental FHIR synchronization, moderate analytics/querying, one de-identified analytics copy, US region, and normal development/production separation. Network egress, high-volume API calls, backups/DR, implementation, premium support and professional services can materially change the number. † Innovaccer and Health Catalyst generally sell enterprise subscriptions/managed programs rather than exposing a simple public per-TB meter, so these are procurement-budget ranges rather than calculated list-price estimates. Health Catalyst, for example, describes enterprise subscription contracts whose pricing depends on client size/data footprint and can include professional services/managed services. [ir.healthcatalyst.com](https://ir.healthcatalyst.com/static-files/68937b6b-d84c-4db4-84c8-b754a60e370c?utm_source=chatgpt.com) ‡ Snowflake's current consumption model means compute is workload-dependent. Its storage pricing is comparatively small; Snowpipe now charges **0.0037 credits/GB ingested**, while compute dominates many analytics workloads. [docs.snowflake.com](https://docs.snowflake.com/en/en/release-notes/2025/other/2025-12-08-snowpipe-simplified-pricing?utm_source=chatgpt.com) ### How I'd rank them for your requirements **1. Google Cloud Healthcare API + BigQuery** — probably the cleanest match if automated de-identification is a hard requirement. Google explicitly prices FHIR de-identification operations, including inspection, transformation and processing, and supports FHIR access-control/consent capabilities. [cloud.google.com](https://cloud.google.com/healthcare-api/pricing?utm_source=chatgpt.com) **2. Azure Health Data Services** — similarly compelling. Azure has a managed FHIR service with audit logging and a dedicated de-identification service that can automatically identify and redact/surrogate 27 entity types, including the 18 HIPAA identifiers. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) **3. AWS HealthLake** — very strong if your team is already AWS-native. It gives you the managed FHIR repository, but you'll assemble more of the analytics/de-identification pipeline from adjacent AWS services rather than getting everything in one healthcare API. HealthLake itself is HIPAA-eligible and fully managed. [aws.amazon.com](https://aws.amazon.com/jp/healthlake/pricing/?utm_source=chatgpt.com) **4. Innovaccer** — worth putting into an RFP if your priority is *“we don't want to build the healthcare data platform ourselves.”* Its Data Activation Platform is explicitly positioned around unifying clinical/claims data, with FHIR and managed healthcare analytics. [innovaccer.com](https://innovaccer.com/health-cloud?utm_source=chatgpt.com) **5. Health Catalyst** — similarly turnkey, particularly if you want healthcare-specific analytics models and implementation expertise rather than a raw cloud data platform. Ignite is explicitly positioned as a healthcare data-and-analytics platform that unifies clinical, financial and claims data. [healthcatalyst.com](https://healthcatalyst.com/products/health-catalyst-ignite-data-and-analytics?utm_source=chatgpt.com) **6. Snowflake** — I'd use this when your core requirement is an excellent governed analytics warehouse rather than an end-to-end FHIR platform. It has strong security/governance and HIPAA/HITRUST positioning, but you'll need an ingestion/FHIR layer and a deliberate de-identification architecture around it. ### A practical target architecture For a startup, I'd avoid putting raw PHI directly into a general-purpose BI warehouse unless you have a strong reason. A good pattern is: **FHIR sources → managed FHIR store → validated/normalized PHI zone → automated de-identification → analytics warehouse/lakehouse → BI/ML** with: - **KMS/customer-managed keys** where appropriate - **RBAC/least privilege** and separate service identities - immutable **audit logs** for PHI access - a separate **de-identified analytics environment** - automated PHI detection/redaction rather than relying solely on application developers - private networking where feasible - retention/deletion policies - BAA covering **every service that actually touches PHI**, including downstream processors For Google specifically, the Healthcare API + de-identification + BigQuery combination is unusually close to this architecture out of the box; Google's documentation also makes clear that the BAA only covers designated services and that **your configuration remains your responsibility**. [aws.amazon.com](https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud/?utm_source=chatgpt.com)[docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/what-is.html?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com)[www.healthcatalyst.com](https://www.healthcatalyst.com/information-security?utm_source=chatgpt.com)[www.snowflake.com](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/terms/hipaa-baa?utm_source=chatgpt.com) **My procurement recommendation:** put **Google, Azure and AWS** through a technical bake-off, and simultaneously get **Innovaccer and Health Catalyst** quotes if “turnkey/low internal engineering” is more important than minimizing infrastructure spend. At only ~2 TB, **engineering/managed-service cost is likely to dominate storage cost**, so I would not select based on the $500–$1,500 difference in underlying cloud infrastructure. If you want, I can also turn this into a **vendor RFP scorecard** with ~25 criteria (BAA language, SOC 2 report scope, FHIR R4/R5, de-ID method, audit retention, CMK, SSO/SAML, private networking, data residency, SLA, implementation time, and 3-year TCO). [AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com) [Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com) [Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services?utm_source=chatgpt.com) [Innovaccer Health Cloud](https://innovaccer.com/health-cloud?utm_source=chatgpt.com) [Health Catalyst Ignite](https://healthcatalyst.com/products/health-catalyst-ignite-data-and-analytics?utm_source=chatgpt.com) [Snowflake Healthcare](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com) | Provider | Deployment | BAA / HIPAA / SOC 2 evidence | Required capabilities | Rough monthly run cost* | Fit | |---|---|---|---|---:|---| | **[AWS HealthLake](https://aws.amazon.com/healthlake/?utm_source=chatgpt.com)** | Cloud-native AWS | HIPAA-eligible; AWS BAA; AWS SOC reports available through AWS Artifact. HealthLake encrypts stored content and requires TLS for connections. [docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/what-is.html?utm_source=chatgpt.com) | Native FHIR persistence/query; encryption; IAM/KMS; CloudTrail audit; integrate Comprehend Medical/Glue/S3 for de-ID and analytics | **~$600–$1,500/mo** | **Best infrastructure-first option** | | **[Google Cloud Healthcare API](https://cloud.google.com/healthcare-api?utm_source=chatgpt.com)** | Cloud-native GCP | Healthcare API is covered by Google Cloud BAA; Google provides SOC 2 reports. [cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com) | FHIR R4; IAM; audit logging; encryption; native de-identification; BigQuery/Looker analytics; consent/access controls | **~$700–$2,000/mo** | **Best integrated FHIR + de-ID + analytics stack** | | **[Azure Health Data Services](https://azure.microsoft.com/en-us/products/health-data-services?utm_source=chatgpt.com)** | Cloud-native Azure | HIPAA/BAA-covered Azure services; Azure advertises 100+ compliance certifications. [azure.microsoft.com](https://azure.microsoft.com/en-us/products/health-data-services?utm_source=chatgpt.com) | Managed FHIR; audit logs; RBAC; encryption; native clinical-data de-identification; Synapse/Fabric/Power BI analytics | **~$700–$2,000/mo** | **Best if you're already Microsoft/Azure-oriented** | | **[Innovaccer Health Cloud](https://innovaccer.com/health-cloud?utm_source=chatgpt.com)** | Cloud-native, primarily managed SaaS/AWS | FHIR-enabled Data Activation Platform has HITRUST CSF certification and operates in AWS; security operations include continuous monitoring. [innovaccer.com](https://innovaccer.com/security?utm_source=chatgpt.com) | Healthcare data ingestion/harmonization; FHIR; identity resolution; analytics; governance/access controls; managed services | **~$5k–$20k+/mo**† | **Strongest turnkey healthcare-data option** | | **[Health Catalyst Ignite](https://healthcatalyst.com/products/health-catalyst-ignite-data-and-analytics?utm_source=chatgpt.com)** | Managed cloud / hybrid enterprise | Health Catalyst states HIPAA adherence, SOC 2 Type II coverage for Ignite/Data & Analytics, and HITRUST certifications for applicable platforms. [www.healthcatalyst.com](https://www.healthcatalyst.com/information-security?utm_source=chatgpt.com) | Healthcare-specific data model; clinical/claims/financial integration; analytics; managed implementation/services | **~$10k–$30k+/mo**† | **Best turnkey analytics + services** | | **[Snowflake Healthcare](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com)** | Cloud-native, multi-cloud | HIPAA/HITRUST support; SOC 2 Type II; automatic encryption; granular governance. [www.snowflake.com](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com) | Excellent analytics/governance; RBAC; masking; audit; Snowpipe FHIR ingestion via surrounding tooling; de-ID generally requires additional implementation | **~$1k–$4k/mo**‡ | **Best analytics layer, least turnkey FHIR** | \* These are **budgetary estimates, not vendor quotes**. I assumed ~2 TB persistently stored, daily incremental FHIR synchronization, moderate analytics/querying, one de-identified analytics copy, US region, and normal development/production separation. Network egress, high-volume API calls, backups/DR, implementation, premium support and professional services can materially change the number. † Innovaccer and Health Catalyst generally sell enterprise subscriptions/managed programs rather than exposing a simple public per-TB meter, so these are procurement-budget ranges rather than calculated list-price estimates. Health Catalyst, for example, describes enterprise subscription contracts whose pricing depends on client size/data footprint and can include professional services/managed services. [ir.healthcatalyst.com](https://ir.healthcatalyst.com/static-files/68937b6b-d84c-4db4-84c8-b754a60e370c?utm_source=chatgpt.com) ‡ Snowflake's current consumption model means compute is workload-dependent. Its storage pricing is comparatively small; Snowpipe now charges **0.0037 credits/GB ingested**, while compute dominates many analytics workloads. [docs.snowflake.com](https://docs.snowflake.com/en/en/release-notes/2025/other/2025-12-08-snowpipe-simplified-pricing?utm_source=chatgpt.com) ### How I'd rank them for your requirements **1. Google Cloud Healthcare API + BigQuery** — probably the cleanest match if automated de-identification is a hard requirement. Google explicitly prices FHIR de-identification operations, including inspection, transformation and processing, and supports FHIR access-control/consent capabilities. [cloud.google.com](https://cloud.google.com/healthcare-api/pricing?utm_source=chatgpt.com) **2. Azure Health Data Services** — similarly compelling. Azure has a managed FHIR service with audit logging and a dedicated de-identification service that can automatically identify and redact/surrogate 27 entity types, including the 18 HIPAA identifiers. [learn.microsoft.com](https://learn.microsoft.com/en-us/azure/healthcare-apis/deidentification/overview?utm_source=chatgpt.com) **3. AWS HealthLake** — very strong if your team is already AWS-native. It gives you the managed FHIR repository, but you'll assemble more of the analytics/de-identification pipeline from adjacent AWS services rather than getting everything in one healthcare API. HealthLake itself is HIPAA-eligible and fully managed. [aws.amazon.com](https://aws.amazon.com/jp/healthlake/pricing/?utm_source=chatgpt.com) **4. Innovaccer** — worth putting into an RFP if your priority is *“we don't want to build the healthcare data platform ourselves.”* Its Data Activation Platform is explicitly positioned around unifying clinical/claims data, with FHIR and managed healthcare analytics. [innovaccer.com](https://innovaccer.com/health-cloud?utm_source=chatgpt.com) **5. Health Catalyst** — similarly turnkey, particularly if you want healthcare-specific analytics models and implementation expertise rather than a raw cloud data platform. Ignite is explicitly positioned as a healthcare data-and-analytics platform that unifies clinical, financial and claims data. [healthcatalyst.com](https://healthcatalyst.com/products/health-catalyst-ignite-data-and-analytics?utm_source=chatgpt.com) **6. Snowflake** — I'd use this when your core requirement is an excellent governed analytics warehouse rather than an end-to-end FHIR platform. It has strong security/governance and HIPAA/HITRUST positioning, but you'll need an ingestion/FHIR layer and a deliberate de-identification architecture around it. ### A practical target architecture For a startup, I'd avoid putting raw PHI directly into a general-purpose BI warehouse unless you have a strong reason. A good pattern is: **FHIR sources → managed FHIR store → validated/normalized PHI zone → automated de-identification → analytics warehouse/lakehouse → BI/ML** with: - **KMS/customer-managed keys** where appropriate - **RBAC/least privilege** and separate service identities - immutable **audit logs** for PHI access - a separate **de-identified analytics environment** - automated PHI detection/redaction rather than relying solely on application developers - private networking where feasible - retention/deletion policies - BAA covering **every service that actually touches PHI**, including downstream processors For Google specifically, the Healthcare API + de-identification + BigQuery combination is unusually close to this architecture out of the box; Google's documentation also makes clear that the BAA only covers designated services and that **your configuration remains your responsibility**. [aws.amazon.com](https://aws.amazon.com/blogs/security/frequently-asked-questions-about-hipaa-compliance-in-the-aws-cloud/?utm_source=chatgpt.com)[docs.aws.amazon.com](https://docs.aws.amazon.com/healthlake/latest/devguide/what-is.html?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/security/compliance/hipaa-compliance?utm_source=chatgpt.com)[www.healthcatalyst.com](https://www.healthcatalyst.com/information-security?utm_source=chatgpt.com)[www.snowflake.com](https://www.snowflake.com/en/solutions/industries/healthcare-and-life-sciences/healthcare-providers/?utm_source=chatgpt.com)[cloud.google.com](https://cloud.google.com/terms/hipaa-baa?utm_source=chatgpt.com) **My procurement recommendation:** put **Google, Azure and AWS** through a technical bake-off, and simultaneously get **Innovaccer and Health Catalyst** quotes if “turnkey/low internal engineering” is more important than minimizing infrastructure spend. At only ~2 TB, **engineering/managed-service cost is likely to dominate storage cost**, so I would not select based on the $500–$1,500 difference in underlying cloud infrastructure. If you want, I can also turn this into a **vendor RFP scorecard** with ~25 criteria (BAA language, SOC 2 report scope, FHIR R4/R5, de-ID method, audit retention, CMK, SSO/SAML, private networking, data residency, SLA, implementation time, and 3-year TCO).

The short answer is: **not by default, and you should verify carefully before using it for PHI.** Softr markets features for healthcare applications (such as patient portals) and states that it provides security features like encryption, role-based permissions, and SOC 2 Type II compliance. However, **SOC 2 compliance is not the same as HIPAA compliance**. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com) If you need to build an application that stores or processes **protected health information (PHI)**, you should confirm all of the following before using Softr: - **Business Associate Agreement (BAA):** A HIPAA-compliant cloud service handling PHI must be willing to sign a BAA with you. This is a core HIPAA requirement. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) - **HIPAA-specific safeguards:** Encryption, access controls, audit logging, breach notification procedures, and administrative controls must all be in place—not just secure infrastructure. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) - **Your data source:** If you're connecting Softr to Airtable, Google Sheets, SQL, or another backend, **every service that stores or transmits PHI must also be HIPAA-eligible and covered by a BAA**. A compliant frontend does not make a non-compliant backend compliant. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) One nuance is that Softr's healthcare marketing pages now refer to "HIPAA-conscious" permissions and even mention "HIPAA-compliant authentication" for certain healthcare templates. These are marketing claims rather than a blanket statement that **the entire platform is HIPAA compliant for all customers and plans**. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) **My recommendation:** If you're planning to handle real patient data, ask Softr these questions before proceeding: 1. Will you sign a **Business Associate Agreement (BAA)**? 2. Which plans include HIPAA support? 3. Which components of the platform are covered by the BAA? 4. What subprocessors are involved, and are they also HIPAA-compliant? 5. What audit logging, access controls, and retention features are available? If Softr **will not sign a BAA** for your intended use, you should assume it is **not suitable for storing or processing PHI**, regardless of its SOC 2 certification. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me your use case (e.g., patient portal, intake forms, scheduling, internal admin app, etc.), I can help determine whether Softr is an appropriate choice or suggest HIPAA-ready alternatives.

Yes — **Knack currently offers a HIPAA-compliant/HIPAA-ready environment through its Knack Health HIPAA plans.** However, there are important conditions. - **BAA:** Knack provides a Business Associate Agreement (BAA) on its HIPAA plans. You need the BAA in place **before storing PHI** in Knack. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com) - **Security controls:** The HIPAA environment includes encryption in transit and at rest, role-based access controls, audit/change logs, 2FA, backups, monitoring, and other security measures. [www.knack.com](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) - **Not automatic:** Knack explicitly says that using the platform doesn't by itself make *your application or organization* HIPAA compliant. Your configuration, access policies, workflows, employee practices, and integrations also matter. [docs.knack.com](https://docs.knack.com/docs/your-responsibilities-as-a-covered-entity?utm_source=chatgpt.com) - **Integrations matter:** If PHI is sent from Knack to another service through an API, Flow, or integration, that service needs to be appropriately HIPAA compliant and have a BAA with you where required. Knack's BAA doesn't cover those third parties. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com) - **Regular Knack vs. HIPAA plan:** Knack's terms specifically prohibit handling PHI unless you're using a HIPAA Environment and have the HIPAA Customer Addendum and BAA in place. [www.knack.com](https://www.knack.com/terms-of-service/?utm_source=chatgpt.com) So, if you're asking **"Can I legally/appropriately store PHI in Knack?"**, the answer is **yes, provided you're on the appropriate Knack Health HIPAA plan, have the BAA executed, and configure/use the application appropriately.** [Knack's HIPAA information](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) If you tell me **what you're planning to store in Knack and what integrations you're using** (e.g., patient names, medical records, intake forms, Stripe, email, Zapier, OpenAI, etc.), I can also assess **whether your specific Knack setup would be HIPAA-safe**. [Knack's HIPAA information](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com)

**Not by default.** Whether ChatGPT can be used with HIPAA-protected health information (PHI) depends on the specific OpenAI product, configuration, and whether you have a **Business Associate Agreement (BAA)** with OpenAI. As of August 2026: - **ChatGPT for Healthcare** is specifically designed for regulated healthcare use and is HIPAA-eligible with a BAA. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com) - **ChatGPT Enterprise with a Regulated Workspace** is also HIPAA-eligible with a BAA. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com) - **OpenAI's API** can be used for PHI when the organization has an appropriate BAA and the required retention configuration. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate?utm_source=chatgpt.com) - **ChatGPT Business does not currently offer a BAA**, so you should not use it to process PHI under a HIPAA-covered workflow. [help.openai.com](https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality?utm_source=chatgpt.com)[help.openai.com](https://help.openai.com/en/articles/8660679-how-can-i-get-a-business-associate?utm_source=chatgpt.com) - Having enterprise security or the fact that OpenAI doesn't train on business data **doesn't by itself make a deployment HIPAA compliant**. Your organization also has configuration, access-control, device-security, retention, and other HIPAA responsibilities. [cdn.openai.com](https://cdn.openai.com/osa/hipaa-guide.pdf?utm_source=chatgpt.com) So, if you're asking **“Can I paste a patient's identifiable medical information into the regular ChatGPT app?”**, the safe answer is **no, unless you're using an appropriately configured HIPAA-eligible OpenAI product under a BAA**. If you tell me **which ChatGPT plan/product you're using (Free, Plus, Pro, Business, Enterprise, Healthcare, or API)**, I can tell you specifically what you can and can't do with PHI.

Yes. **Caspio currently offers a HIPAA-compliant version of its platform**, called the **HIPAA Edition**. It is specifically designed for applications that store or process protected health information (PHI). [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) Key points: - **Signed BAA:** Caspio provides a Business Associate Agreement (BAA) to HIPAA Edition customers. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) - **Encryption:** Data is encrypted both at rest and in transit. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) - **Access controls:** It supports role-based permissions, authentication controls, and other mechanisms for restricting PHI access. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) - **Audit logging:** Caspio provides system-wide audit trails covering data activity such as reads, writes, edits, and deletions. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) - **Dedicated HIPAA environment:** HIPAA accounts operate in a dedicated environment with HIPAA-specific safeguards. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)[www.caspio.com](https://www.caspio.com/hipaa-edition/?utm_source=chatgpt.com) - **SOC 2 Type II:** Caspio says its controls are independently audited and that it maintains SOC 2 Type II certification. [www.caspio.com](https://www.caspio.com/compliance/?utm_source=chatgpt.com) **Important distinction:** Using Caspio does **not automatically make your application HIPAA compliant**. Caspio's own terms state that processing PHI requires both an **executed BAA and a HIPAA Account**, and your organization remains responsible for configuring and operating the application appropriately. [www.caspio.com](https://www.caspio.com/caspio-platform-terms-of-service/?utm_source=chatgpt.com) If you're considering Caspio for a **specific healthcare application**, I can also break down **exactly what you would need to configure in Caspio to make the application HIPAA compliant**, including forms, user authentication, permissions, audit logs, APIs, and backups.

For a small healthcare practice, I’d treat this as **a security/compliance procurement project first and a software-development project second**. “HIPAA compliant” is not a product certification, and HHS explicitly says it does not endorse or certify particular technology products. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=chatgpt.com) ### 1. Decide whether you actually need a custom portal Before soliciting developers, define what the portal must do: - Secure patient login/account creation - Appointment requests or scheduling - Secure messaging - Forms/intake questionnaires - Document upload/download - Lab or clinical-document delivery - Billing/payment integration, if needed - EHR/EMR integration - Email/SMS notifications - Staff/admin dashboard - Patient identity verification and account recovery - Audit logging If the requirements are mostly standard patient-portal functions, compare **established healthcare portal products** against custom development. Custom software makes sense when you have unusual workflows, integrations, or patient experience requirements that off-the-shelf products can't handle. ### 2. Make HIPAA requirements part of the vendor evaluation—not a checkbox The vendor should be willing to sign a **Business Associate Agreement (BAA)** if it will create, receive, maintain, or transmit PHI for you. HHS specifically says that a cloud provider handling ePHI on behalf of a covered entity is generally a business associate and needs a HIPAA-compliant BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Ask every candidate: 1. **Will you sign our BAA?** 2. **Which subcontractors can access PHI?** 3. **Which cloud infrastructure will you use?** 4. **Where is PHI stored and processed?** 5. **How is data encrypted in transit and at rest?** 6. **How are employees/admins authenticated and authorized?** 7. **Is MFA mandatory for staff?** 8. **What audit logs are maintained?** 9. **How are vulnerabilities discovered and patched?** 10. **Do you perform penetration testing? How often?** 11. **What is your breach/incident notification procedure?** 12. **How are backups protected and restored?** 13. **What happens to our PHI when we terminate the contract?** 14. **Can we export all of our data in a usable format?** 15. **What security documentation can you provide?** Don't accept “We're HIPAA compliant” as the answer. Ask for the **architecture, controls, contracts, and evidence** behind that claim. ### 3. Pay particular attention to the BAA Your BAA should address things such as permitted uses/disclosures, safeguards, breach reporting, access to PHI, termination, return/destruction of PHI, and subcontractors. HHS provides a useful outline of the required BAA provisions. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) I'd also negotiate an SLA covering things such as uptime, backups/recovery, security responsibilities, data retention, and what happens to your data when the relationship ends. HHS specifically identifies these as issues that can be addressed contractually. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Have a healthcare/privacy attorney review the BAA and master services agreement before signing. ### 4. Ask about security architecture, not just encryption Encryption is necessary but **not sufficient**. HHS notes that encryption by itself doesn't address things such as access controls, risk analysis, integrity, availability, administrative safeguards, and disaster recovery. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) For a portal I'd want to see, at minimum: | Area | What I'd look for | |---|---| | Authentication | MFA for staff; strong patient authentication/recovery | | Authorization | Role-based access; least privilege | | Data | Encryption in transit and at rest | | Sessions | Secure cookies, timeouts, session invalidation | | Auditability | Logs of access, changes, downloads, administrative actions | | Infrastructure | HIPAA-appropriate cloud architecture | | Development | Secure SDLC, code review, dependency management | | Testing | Vulnerability scanning + independent penetration testing | | Operations | Monitoring, incident response, patching | | Availability | Backups, disaster recovery, tested restoration | | Privacy | No PHI in ordinary analytics/marketing tools unless appropriately covered | | Integrations | Explicit security model for EHR, email, SMS, payments, etc. | And importantly, determine **which controls are the vendor's responsibility and which remain yours**. HHS recommends that the parties establish these responsibilities in writing. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 5. Require evidence A strong vendor shouldn't get defensive when you ask for evidence. Depending on the vendor's size, useful evidence includes: - SOC 2 Type II report - Recent penetration-test executive summary - Vulnerability-management policy - Incident-response policy - Disaster-recovery/BCP documentation - Security awareness/training practices - Access-control policy - Encryption specifications - Data-flow/architecture diagram - Subprocessor list - BAA template - Cyber-insurance coverage SOC 2 isn't itself a HIPAA requirement, so don't automatically reject a smaller vendor that doesn't have it. Conversely, don't assume a SOC 2 report means the application automatically satisfies your HIPAA obligations. HHS notes that customers aren't automatically entitled under HIPAA to audit a cloud provider's security practices, but you **can negotiate additional assurances and documentation** through the BAA, SLA, or other agreements. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 6. Evaluate the development vendor itself If you're hiring an agency to build the portal, ask: - How many healthcare/HIPAA projects have you delivered? - Can we speak to two healthcare clients? - Who is responsible for security after launch? - Who owns the source code and infrastructure? - Can another developer take over the system? - How do you handle open-source dependencies? - How quickly do you patch critical vulnerabilities? - What happens if your company goes out of business? - What happens if we terminate the development agreement? - Will your developers have access to production PHI? - Can development/testing environments operate entirely on synthetic data? **That last point is particularly important:** don't let developers casually copy production patient data into development, staging, analytics, screenshots, or debugging systems. ### 7. Do your own risk analysis Don't outsource the entire HIPAA responsibility to the vendor. HHS describes risk analysis as foundational to Security Rule compliance and says it should encompass the ePHI your organization creates, receives, maintains, or transmits. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) For a small practice, I'd map the data flow: **Patient → Portal → Application → Database → EHR/other systems → Staff** Then identify every other service involved: **email + SMS + authentication + cloud hosting + file storage + analytics + payment + support + backups** For each one, ask: **Does this service touch PHI? If so, what is the legal/security arrangement?** HHS/ONC also have a Security Risk Assessment Tool specifically intended to help small and medium-sized healthcare practices and business associates. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 8. Score vendors instead of choosing by demo quality I'd use something roughly like: | Criterion | Weight | |---|---:| | Security architecture & engineering | 25% | | HIPAA/BAA experience | 20% | | Relevant healthcare experience | 15% | | EHR/integration capability | 10% | | Reliability/DR/operations | 10% | | Data ownership/export/portability | 10% | | UX & accessibility | 5% | | Price | 5% | **Don't make price the dominant factor.** A cheap portal that creates security, integration, or vendor-lock-in problems can become dramatically more expensive. ### 9. Red flags I'd be very cautious if a vendor: - Says “HIPAA certified” without explaining what they mean - Won't sign a BAA - Can't identify where PHI is stored - Won't identify subprocessors - Has no clear incident-response process - Has no meaningful audit logging - Uses production PHI for development/testing without a compelling, controlled reason - Can't explain their backup/recovery strategy - Says encryption alone makes the system HIPAA compliant - Won't provide security documentation - Wants to put PHI into ordinary analytics/marketing services without an appropriate legal/security arrangement - Can't explain who owns the source code and data - Makes you dependent on them for data export ### A practical selection process For a small practice, I'd shortlist **3–5 vendors**, give each exactly the same requirements document, and have them respond to the same security questionnaire. Then narrow it to two finalists. For the finalists, do: **Requirements → written proposal → architecture/security review → reference checks → contract/BAA review → security testing → limited pilot → production** The most important thing is to avoid selecting someone because they give you the best-looking demo. **You want a vendor that can demonstrate a defensible security architecture, appropriate contractual protections, mature operational practices, and a realistic understanding of healthcare workflows.** If you tell me **what kind of practice this is, approximate patient volume, whether you already have an EHR, and what you want the portal to do**, I can also help you determine whether you should **buy an existing portal or commission a custom one**, and give you a vendor-evaluation scorecard tailored to the practice. | Area | What I'd look for | |---|---| | Authentication | MFA for staff; strong patient authentication/recovery | | Authorization | Role-based access; least privilege | | Data | Encryption in transit and at rest | | Sessions | Secure cookies, timeouts, session invalidation | | Auditability | Logs of access, changes, downloads, administrative actions | | Infrastructure | HIPAA-appropriate cloud architecture | | Development | Secure SDLC, code review, dependency management | | Testing | Vulnerability scanning + independent penetration testing | | Operations | Monitoring, incident response, patching | | Availability | Backups, disaster recovery, tested restoration | | Privacy | No PHI in ordinary analytics/marketing tools unless appropriately covered | | Integrations | Explicit security model for EHR, email, SMS, payments, etc. | And importantly, determine **which controls are the vendor's responsibility and which remain yours**. HHS recommends that the parties establish these responsibilities in writing. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 5. Require evidence A strong vendor shouldn't get defensive when you ask for evidence. Depending on the vendor's size, useful evidence includes: - SOC 2 Type II report - Recent penetration-test executive summary - Vulnerability-management policy - Incident-response policy - Disaster-recovery/BCP documentation - Security awareness/training practices - Access-control policy - Encryption specifications - Data-flow/architecture diagram - Subprocessor list - BAA template - Cyber-insurance coverage SOC 2 isn't itself a HIPAA requirement, so don't automatically reject a smaller vendor that doesn't have it. Conversely, don't assume a SOC 2 report means the application automatically satisfies your HIPAA obligations. HHS notes that customers aren't automatically entitled under HIPAA to audit a cloud provider's security practices, but you **can negotiate additional assurances and documentation** through the BAA, SLA, or other agreements. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 6. Evaluate the development vendor itself If you're hiring an agency to build the portal, ask: - How many healthcare/HIPAA projects have you delivered? - Can we speak to two healthcare clients? - Who is responsible for security after launch? - Who owns the source code and infrastructure? - Can another developer take over the system? - How do you handle open-source dependencies? - How quickly do you patch critical vulnerabilities? - What happens if your company goes out of business? - What happens if we terminate the development agreement? - Will your developers have access to production PHI? - Can development/testing environments operate entirely on synthetic data? **That last point is particularly important:** don't let developers casually copy production patient data into development, staging, analytics, screenshots, or debugging systems. ### 7. Do your own risk analysis Don't outsource the entire HIPAA responsibility to the vendor. HHS describes risk analysis as foundational to Security Rule compliance and says it should encompass the ePHI your organization creates, receives, maintains, or transmits. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) For a small practice, I'd map the data flow: **Patient → Portal → Application → Database → EHR/other systems → Staff** Then identify every other service involved: **email + SMS + authentication + cloud hosting + file storage + analytics + payment + support + backups** For each one, ask: **Does this service touch PHI? If so, what is the legal/security arrangement?** HHS/ONC also have a Security Risk Assessment Tool specifically intended to help small and medium-sized healthcare practices and business associates. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 8. Score vendors instead of choosing by demo quality I'd use something roughly like: | Criterion | Weight | |---|---:| | Security architecture & engineering | 25% | | HIPAA/BAA experience | 20% | | Relevant healthcare experience | 15% | | EHR/integration capability | 10% | | Reliability/DR/operations | 10% | | Data ownership/export/portability | 10% | | UX & accessibility | 5% | | Price | 5% | **Don't make price the dominant factor.** A cheap portal that creates security, integration, or vendor-lock-in problems can become dramatically more expensive. ### 9. Red flags I'd be very cautious if a vendor: - Says “HIPAA certified” without explaining what they mean - Won't sign a BAA - Can't identify where PHI is stored - Won't identify subprocessors - Has no clear incident-response process - Has no meaningful audit logging - Uses production PHI for development/testing without a compelling, controlled reason - Can't explain their backup/recovery strategy - Says encryption alone makes the system HIPAA compliant - Won't provide security documentation - Wants to put PHI into ordinary analytics/marketing services without an appropriate legal/security arrangement - Can't explain who owns the source code and data - Makes you dependent on them for data export ### A practical selection process For a small practice, I'd shortlist **3–5 vendors**, give each exactly the same requirements document, and have them respond to the same security questionnaire. Then narrow it to two finalists. For the finalists, do: **Requirements → written proposal → architecture/security review → reference checks → contract/BAA review → security testing → limited pilot → production** The most important thing is to avoid selecting someone because they give you the best-looking demo. **You want a vendor that can demonstrate a defensible security architecture, appropriate contractual protections, mature operational practices, and a realistic understanding of healthcare workflows.** If you tell me **what kind of practice this is, approximate patient volume, whether you already have an EHR, and what you want the portal to do**, I can also help you determine whether you should **buy an existing portal or commission a custom one**, and give you a vendor-evaluation scorecard tailored to the practice.

Yes. You can build a useful HIPAA-compliant **client/patient portal without coding**, but there’s an important distinction: > **Using a HIPAA-capable platform does not automatically make your entire portal HIPAA compliant.** You still need the right configuration, contracts, access controls, policies, and risk analysis. HHS specifically says that if a cloud provider creates, receives, maintains, or transmits ePHI for you, you generally need a **Business Associate Agreement (BAA)** with that provider. You also remain responsible for your own HIPAA obligations and risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### The easiest no-code approach For a small practice, therapist, consultant, home-health business, or similar operation, I'd build it like this: **Patient → branded portal → secure forms/files → staff dashboard → automated workflows** A particularly straightforward option is [Jotform](https://www.jotform.com/?utm_source=chatgpt.com). Its HIPAA-enabled offering supports no-code forms, file uploads, e-signatures, appointments, and a mobile healthcare app, and eligible HIPAA accounts receive a BAA. [www.jotform.com](https://www.jotform.com/hipaa/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) You can essentially make the "portal" an app-like experience containing: - **Welcome/dashboard** - New-client intake - Medical history questionnaire - Consent forms - HIPAA/privacy acknowledgments - Secure document upload - Documents you've sent to the client - E-signatures - Appointment requests - Secure messages/workflow notifications - Payment collection, if appropriate - Client-specific forms/tasks Jotform also provides no-code medical-app templates that can combine forms, signatures, file uploads, and patient information. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com) ### Another good option: Formstack [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) is worth considering if you need more sophisticated workflows. Its HIPAA-enabled setup includes encryption, user-level permissions, audit logging, secure routing, file uploads, e-signatures, and workflow management. Formstack also provides a BAA for its healthcare offering. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) I'd lean toward **Formstack** when the portal is more workflow-heavy, and **Jotform** when you want the fastest DIY build. ### What I would *not* do Don't assemble a HIPAA portal from ordinary consumer tools such as: - Google Forms - ordinary Gmail - Dropbox/Google Drive without verifying the exact HIPAA configuration and BAA - Airtable's ordinary configuration - Notion - Webflow + random form provider - Zapier/Make integrations that haven't been specifically evaluated for your PHI workflow The issue isn't simply whether the website has HTTPS. **Every system that handles PHI needs to be considered.** HHS notes that even a cloud provider storing only encrypted ePHI can still be a business associate and require a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### A practical build I'd structure a simple portal like this: | Portal area | What the client sees | |---|---| | **Home** | "You have 3 tasks to complete" | | **My Forms** | Intake, history, consent | | **My Documents** | Documents you've shared | | **Upload** | Secure document/photo upload | | **Appointments** | Request/schedule appointment | | **Payments** | Outstanding balance/payment | | **Messages** | Secure communication | | **Profile** | Contact information | | **Help** | Contact your office | Then create automated workflows: **New client** → invite client → client creates/authenticates account → intake form → consent → upload documents → staff review → mark onboarding complete **Existing client** → assign new form → client receives notification → completes form → staff receives task → record is stored securely ### The HIPAA checklist that matters Before putting real PHI into it, I'd verify: 1. **BAA** — You have a signed BAA with every vendor that handles your ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) 2. **Authentication** — Don't use shared client accounts. 3. **Access controls** — Staff only see information they need. 4. **Auditability** — You can determine who accessed/changed information. 5. **Encryption** — Data is protected in transit and at rest. 6. **Backups/recovery** — You have a plan for availability and data recovery. 7. **Integrations** — Every downstream service touching PHI is evaluated too. 8. **Email/SMS** — Don't casually put PHI into ordinary notification messages. 9. **Data retention/deletion** — Know what happens when a client leaves. 10. **Risk analysis** — Document the risks associated with the system and how you're mitigating them. HHS explicitly says covered entities and business associates need to conduct risk analyses addressing threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### My recommendation If you're trying to get this running **quickly and inexpensively without a developer**, I'd start with: **Jotform HIPAA account → Jotform Health App → branded forms → secure uploads → e-signatures → automated staff workflows.** That gets you surprisingly close to a custom client portal without programming. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) If you need something that behaves more like a **full EHR/client-management system**—persistent client profiles, clinical notes, secure messaging, scheduling, billing, treatment plans, etc.—I'd look at a healthcare-specific portal/EHR rather than trying to recreate one with a no-code form builder. If you tell me **what kind of practice/business this is and exactly what you want clients to be able to do in the portal**, I can lay out the cheapest no-code stack and the exact screens/workflows I'd use. [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) | Portal area | What the client sees | |---|---| | **Home** | "You have 3 tasks to complete" | | **My Forms** | Intake, history, consent | | **My Documents** | Documents you've shared | | **Upload** | Secure document/photo upload | | **Appointments** | Request/schedule appointment | | **Payments** | Outstanding balance/payment | | **Messages** | Secure communication | | **Profile** | Contact information | | **Help** | Contact your office | Then create automated workflows: **New client** → invite client → client creates/authenticates account → intake form → consent → upload documents → staff review → mark onboarding complete **Existing client** → assign new form → client receives notification → completes form → staff receives task → record is stored securely ### The HIPAA checklist that matters Before putting real PHI into it, I'd verify: 1. **BAA** — You have a signed BAA with every vendor that handles your ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) 2. **Authentication** — Don't use shared client accounts. 3. **Access controls** — Staff only see information they need. 4. **Auditability** — You can determine who accessed/changed information. 5. **Encryption** — Data is protected in transit and at rest. 6. **Backups/recovery** — You have a plan for availability and data recovery. 7. **Integrations** — Every downstream service touching PHI is evaluated too. 8. **Email/SMS** — Don't casually put PHI into ordinary notification messages. 9. **Data retention/deletion** — Know what happens when a client leaves. 10. **Risk analysis** — Document the risks associated with the system and how you're mitigating them. HHS explicitly says covered entities and business associates need to conduct risk analyses addressing threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### My recommendation If you're trying to get this running **quickly and inexpensively without a developer**, I'd start with: **Jotform HIPAA account → Jotform Health App → branded forms → secure uploads → e-signatures → automated staff workflows.** That gets you surprisingly close to a custom client portal without programming. [www.jotform.com](https://www.jotform.com/medical-app-creator/?utm_source=chatgpt.com)[www.jotform.com](https://www.jotform.com/hipaa/health-app/?utm_source=chatgpt.com) If you need something that behaves more like a **full EHR/client-management system**—persistent client profiles, clinical notes, secure messaging, scheduling, billing, treatment plans, etc.—I'd look at a healthcare-specific portal/EHR rather than trying to recreate one with a no-code form builder. If you tell me **what kind of practice/business this is and exactly what you want clients to be able to do in the portal**, I can lay out the cheapest no-code stack and the exact screens/workflows I'd use.

Yes. **A no-code front end can absolutely sit on top of a HIPAA-compliant backend**, but the key is that HIPAA compliance applies to the *overall system and how PHI flows through it*, not simply to the backend. A common architecture is: **No-code frontend → API → HIPAA-capable backend/database → other healthcare services** For example, the frontend could handle forms, dashboards, scheduling, or patient/provider workflows, while the backend handles PHI, authentication, authorization, audit logs, database storage, and business logic. ### The big catch If the no-code frontend **receives, stores, transmits, or otherwise handles PHI**, you need to determine whether that vendor is a HIPAA business associate and whether it will sign a **BAA (Business Associate Agreement)** with you. HHS specifically says that cloud services processing or storing ePHI on behalf of a covered entity/business associate generally qualify as business associates and require a BAA. This can be true even when the data is encrypted. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) So, for example: | Component | Can it be no-code? | HIPAA concern | |---|---|---| | Marketing website | Yes | Usually none if no PHI | | Patient-facing UI | Yes | **Vendor must be evaluated if it handles PHI** | | Forms | Yes | PHI may pass through vendor | | Backend/API | Yes/low-code | Must appropriately handle PHI | | Database | Yes | Must be configured for HIPAA requirements | | Authentication | Yes | Need appropriate security/access controls | | Analytics | Maybe | **Be very careful with PHI leakage** | | Email/SMS | Maybe | Vendor and workflow need HIPAA evaluation | ### A particularly good pattern If you want maximum flexibility, you can design the no-code frontend so that it **doesn't persist PHI itself**: ```text Patient ↓ No-code UI ↓ Secure API ↓ HIPAA-capable backend ↓ HIPAA-capable database ``` The frontend can essentially be a presentation layer. Your backend controls the sensitive operations and data. But don't assume that makes the frontend automatically "HIPAA safe." If PHI passes through the no-code vendor's servers, logs, form submissions, analytics, error reporting, etc., that vendor may still be involved in handling ePHI. HHS notes that encryption alone doesn't remove a cloud provider's business-associate obligations. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I'd look for in a no-code stack I'd specifically verify: 1. **Does the vendor sign a BAA?** 2. Can you disable or control **vendor logging/analytics**? 3. Where are submitted form values stored? 4. Does the vendor retain data in backups? 5. Does customer data appear in support tools? 6. Can you enforce strong authentication and authorization? 7. Can you prevent PHI from going to third-party analytics? 8. Can you get appropriate audit/security documentation? 9. Can you delete/export PHI when required? 10. Do all downstream vendors that touch PHI have appropriate BAAs? Also remember that **there isn't a simple "HIPAA-certified" checkbox that makes an application compliant**. HHS doesn't endorse or certify specific technology products; the organization using the technology still has compliance and risk-analysis responsibilities. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=chatgpt.com) If you tell me **which no-code frontend you're considering** (Bubble, FlutterFlow, WeWeb, Retool, Softr, Glide, Webflow, etc.) and **which backend** (Supabase, Firebase, AWS, Azure, custom API, etc.), I can tell you whether that particular combination is realistic for HIPAA and what the architecture should look like. | Component | Can it be no-code? | HIPAA concern | |---|---|---| | Marketing website | Yes | Usually none if no PHI | | Patient-facing UI | Yes | **Vendor must be evaluated if it handles PHI** | | Forms | Yes | PHI may pass through vendor | | Backend/API | Yes/low-code | Must appropriately handle PHI | | Database | Yes | Must be configured for HIPAA requirements | | Authentication | Yes | Need appropriate security/access controls | | Analytics | Maybe | **Be very careful with PHI leakage** | | Email/SMS | Maybe | Vendor and workflow need HIPAA evaluation | ### A particularly good pattern If you want maximum flexibility, you can design the no-code frontend so that it **doesn't persist PHI itself**: ```text Patient ↓ No-code UI ↓ Secure API ↓ HIPAA-capable backend ↓ HIPAA-capable database ``` The frontend can essentially be a presentation layer. Your backend controls the sensitive operations and data. But don't assume that makes the frontend automatically "HIPAA safe." If PHI passes through the no-code vendor's servers, logs, form submissions, analytics, error reporting, etc., that vendor may still be involved in handling ePHI. HHS notes that encryption alone doesn't remove a cloud provider's business-associate obligations. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I'd look for in a no-code stack I'd specifically verify: 1. **Does the vendor sign a BAA?** 2. Can you disable or control **vendor logging/analytics**? 3. Where are submitted form values stored? 4. Does the vendor retain data in backups? 5. Does customer data appear in support tools? 6. Can you enforce strong authentication and authorization? 7. Can you prevent PHI from going to third-party analytics? 8. Can you get appropriate audit/security documentation? 9. Can you delete/export PHI when required? 10. Do all downstream vendors that touch PHI have appropriate BAAs? Also remember that **there isn't a simple "HIPAA-certified" checkbox that makes an application compliant**. HHS doesn't endorse or certify specific technology products; the organization using the technology still has compliance and risk-analysis responsibilities. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=chatgpt.com) If you tell me **which no-code frontend you're considering** (Bubble, FlutterFlow, WeWeb, Retool, Softr, Glide, Webflow, etc.) and **which backend** (Supabase, Firebase, AWS, Azure, custom API, etc.), I can tell you whether that particular combination is realistic for HIPAA and what the architecture should look like.