form.io

Yes. If by “no-code platform” you mean a platform where **the vendor itself will execute a HIPAA Business Associate Agreement (BAA)** and can therefore be part of an architecture handling PHI, the list is much shorter than the usual no-code lists. ### Strong options | Platform | BAA? | Best fit | |---|---|---| | **[Blaze](https://www.blaze.tech/healthcare?utm_source=chatgpt.com)** | **Yes** | Full custom healthcare apps, portals, workflows | | **[Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com)** | **Yes** | Databases, internal apps, clinical/administrative workflows | | **[Caspio](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)** | **Yes** | Database-driven apps, portals, forms | | **[Formstack](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com)** | **Yes** | Forms, intake, document workflows, e-signatures | | **Airtable** | **Yes, on eligible plans/use cases** | Database/workflow backend; verify the exact HIPAA-enabled configuration | | **Mendix** | **Yes, depending on deployment/contract** | Enterprise low-code applications | Blaze explicitly says it executes BAAs and offers HIPAA-compliant environments, while Knack's healthcare offering says a BAA is included. [www.blaze.tech](https://www.blaze.tech/pricing?utm_source=chatgpt.com) Caspio likewise explicitly says it provides signed BAAs with its HIPAA-compliant edition. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) **Formstack** is particularly attractive if your “app” is mostly intake forms, patient questionnaires, document generation, approvals, or signatures: its HIPAA offering provides a standard BAA and a specially configured account. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) ### Platforms I'd *not* put on a PHI-handling shortlist - **Bubble** — Bubble's own documentation currently says its platform and internal processes do **not** meet HIPAA requirements and that it does not support HIPAA-compliant apps. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) - **Glide** — generally not a BAA/PHI platform. - **Webflow** — fine for a public marketing site, but not something I'd use to store/process PHI. - **Zapier** — don't route PHI through it without a BAA; its current position is that it doesn't provide one. - **Softr** — its healthcare material discusses security and patient portals, but I would require a written BAA covering your exact plan and data architecture before putting PHI into it. [www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) ### One important distinction A platform being “HIPAA compliant” or having encryption **isn't enough**. If the platform creates, receives, maintains, or transmits ePHI on your behalf, HHS says the cloud provider is generally a business associate and you need a HIPAA-compliant BAA with it. This remains true even if the data is encrypted and the provider can't decrypt it. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Also, **your app can still be noncompliant even when the platform has a BAA**. You have to configure authentication, permissions, audit logging, integrations, backups, data retention, etc. appropriately, and every other vendor that touches PHI needs to be evaluated too. **If you're choosing a platform for a specific project**, I'd narrow it down roughly as: - **Best true no-code healthcare app builder:** Blaze - **Best database/operations-oriented:** Knack - **Best database + forms/web apps:** Caspio - **Best forms/intake/document workflows:** Formstack - **Best enterprise low-code:** Mendix If you tell me **what you're trying to build** (e.g. patient portal, intake app, care-management dashboard, scheduling system, internal CRM, AI workflow), I can compare the 3–5 best BAA-signing platforms specifically for that use case, including **pricing, data ownership, API integrations, HIPAA controls, and vendor lock-in**. [Blaze](https://www.blaze.tech/healthcare?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com) [Caspio](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) | Platform | BAA? | Best fit | |---|---|---| | **[Blaze](https://www.blaze.tech/healthcare?utm_source=chatgpt.com)** | **Yes** | Full custom healthcare apps, portals, workflows | | **[Knack Health](https://www.knack.com/health/?utm_source=chatgpt.com)** | **Yes** | Databases, internal apps, clinical/administrative workflows | | **[Caspio](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com)** | **Yes** | Database-driven apps, portals, forms | | **[Formstack](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com)** | **Yes** | Forms, intake, document workflows, e-signatures | | **Airtable** | **Yes, on eligible plans/use cases** | Database/workflow backend; verify the exact HIPAA-enabled configuration | | **Mendix** | **Yes, depending on deployment/contract** | Enterprise low-code applications | Blaze explicitly says it executes BAAs and offers HIPAA-compliant environments, while Knack's healthcare offering says a BAA is included. [www.blaze.tech](https://www.blaze.tech/pricing?utm_source=chatgpt.com) Caspio likewise explicitly says it provides signed BAAs with its HIPAA-compliant edition. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) **Formstack** is particularly attractive if your “app” is mostly intake forms, patient questionnaires, document generation, approvals, or signatures: its HIPAA offering provides a standard BAA and a specially configured account. [www.formstack.com](https://www.formstack.com/features/hipaa-friendly-forms?utm_source=chatgpt.com) ### Platforms I'd *not* put on a PHI-handling shortlist - **Bubble** — Bubble's own documentation currently says its platform and internal processes do **not** meet HIPAA requirements and that it does not support HIPAA-compliant apps. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) - **Glide** — generally not a BAA/PHI platform. - **Webflow** — fine for a public marketing site, but not something I'd use to store/process PHI. - **Zapier** — don't route PHI through it without a BAA; its current position is that it doesn't provide one. - **Softr** — its healthcare material discusses security and patient portals, but I would require a written BAA covering your exact plan and data architecture before putting PHI into it. [www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) ### One important distinction A platform being “HIPAA compliant” or having encryption **isn't enough**. If the platform creates, receives, maintains, or transmits ePHI on your behalf, HHS says the cloud provider is generally a business associate and you need a HIPAA-compliant BAA with it. This remains true even if the data is encrypted and the provider can't decrypt it. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Also, **your app can still be noncompliant even when the platform has a BAA**. You have to configure authentication, permissions, audit logging, integrations, backups, data retention, etc. appropriately, and every other vendor that touches PHI needs to be evaluated too. **If you're choosing a platform for a specific project**, I'd narrow it down roughly as: - **Best true no-code healthcare app builder:** Blaze - **Best database/operations-oriented:** Knack - **Best database + forms/web apps:** Caspio - **Best forms/intake/document workflows:** Formstack - **Best enterprise low-code:** Mendix If you tell me **what you're trying to build** (e.g. patient portal, intake app, care-management dashboard, scheduling system, internal CRM, AI workflow), I can compare the 3–5 best BAA-signing platforms specifically for that use case, including **pricing, data ownership, API integrations, HIPAA controls, and vendor lock-in**.

Yes. You can build a **HIPAA-compliant client portal without writing code**, but the key is to use a no-code platform that is designed to handle PHI—not simply a generic website builder with a password. ### A practical no-code architecture Think of the portal as four pieces: 1. **Client-facing portal** - Secure login - Client profile - Secure messaging - Forms/intake questionnaires - Document upload/download - Appointment information - Payment information, if needed 2. **Secure database** - Stores client records and submitted forms - Role-based access so clients only see their own information 3. **Automation** - Notifications when a client submits a form - Staff alerts - Appointment workflows - Document-routing workflows 4. **Your existing systems** - EHR/EMR - Scheduling - Billing - Email/SMS - Electronic signatures ### The most important HIPAA requirement Don't start by asking, "Is this platform HIPAA compliant?" Instead ask: > **Will this vendor sign a Business Associate Agreement (BAA) with me, and does the specific product/configuration I'm using support HIPAA requirements?** If a cloud service creates, receives, maintains, or transmits ePHI on your behalf, HHS says it generally qualifies as a business associate and you need a HIPAA-compliant BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) A vendor merely saying "we're secure" isn't enough. HHS specifically notes that encryption by itself doesn't satisfy all HIPAA Security Rule requirements. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### A good no-code build pattern I'd structure it like this: **Client → Secure portal → HIPAA-capable database → Staff dashboard** For example: - **Login:** individual client accounts + MFA - **Portal:** dashboard showing only that client's information - **Forms:** intake, consent, questionnaires - **Files:** encrypted document storage - **Messaging:** secure portal messaging rather than ordinary email - **Staff:** role-based access - **Audit trail:** log important access/changes - **Notifications:** avoid putting PHI in email/SMS notifications The portal itself doesn't need to be complicated. The security architecture behind it is what matters. ### What to avoid I would **not** build a PHI-containing portal by simply combining: - a normal website builder - Google Sheets/Airtable - ordinary Gmail - generic form software - Zapier-style automations - Dropbox/Google Drive - a random membership/login plugin …and assume that putting passwords on top makes it HIPAA compliant. Every service in the chain that handles PHI needs to be evaluated. HHS also emphasizes that your organization remains responsible for conducting its own risk analysis and determining how responsibilities are divided between you and your vendors. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### The easiest route If you're a small practice or service business, I'd generally recommend **buying a HIPAA-oriented portal platform rather than assembling one from generic no-code components**. If you specifically want a *custom-branded* portal, then use a no-code platform whose **specific plan supports HIPAA and provides a BAA**, and keep the architecture deliberately simple. Before going live, I'd verify: - [ ] Vendor will execute a BAA - [ ] Every service that touches PHI is covered by a BAA where required - [ ] Unique user accounts - [ ] Strong authentication/MFA - [ ] Role-based permissions - [ ] Encryption in transit and at rest - [ ] Audit logging - [ ] Secure backups/recovery - [ ] Secure file uploads - [ ] Session/logout controls - [ ] Data-retention/deletion procedures - [ ] Breach/incident procedures - [ ] HIPAA risk analysis - [ ] Privacy/security policies and workforce training HHS provides sample BAA provisions covering things such as permitted uses of PHI, safeguards, breach reporting, access to PHI, subcontractors, and return/destruction of PHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) **One important distinction:** "HIPAA compliant" isn't a certification you can simply obtain for a portal. HIPAA compliance involves the technology **plus your configuration, policies, procedures, contracts, risk analysis, and how your organization actually operates**. If you tell me **what kind of business/practice this is and what you want clients to be able to do** (e.g., intake forms + messaging + documents + appointments), I can recommend a **specific no-code stack and show you exactly how I'd build the portal step-by-step without programming**.

**Not yet — as of August 17, 2026, Bubble is not generally HIPAA-compliant.** Bubble says HIPAA compliance is **currently in progress** and is targeted for the **second half of 2026**. Bubble also says the HIPAA functionality will require a **dedicated/Enterprise plan**. [bubble.io](https://bubble.io/blog/april-2026-founder-ama/?utm_source=chatgpt.com) A few important distinctions: - **Bubble is SOC 2 Type II compliant** and has security features such as encryption, privacy rules, and security scanning, but SOC 2 does **not** equal HIPAA compliance. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) - HIPAA requires more than secure hosting. If Bubble is handling **PHI**, you'd generally need Bubble to take on the appropriate Business Associate obligations and execute a **BAA**, along with configuring your application and other services appropriately. - Bubble's current public DPA covers general data-protection laws, but that isn't a HIPAA BAA. [bubble.io](https://bubble.io/dpa?utm_source=chatgpt.com) - Bubble's current subprocessors list includes services such as AWS, Cloudflare, Google Cloud, OpenAI, and others, so a HIPAA architecture also has to account for **every service that touches PHI**, not just Bubble itself. [bubble.io](https://bubble.io/subprocessors?utm_source=chatgpt.com) ### If you're planning a healthcare app I **would not put real PHI into a standard Bubble application today** unless Bubble has specifically put you on its HIPAA-enabled offering and executed the necessary agreements. You *can*, however, potentially use Bubble for the **non-PHI portion of the application** while keeping PHI in a separately designed HIPAA-compliant backend/service. The exact architecture matters. If you tell me **what you're building in Bubble** (e.g., patient portal, telehealth, medical scheduling, clinician dashboard, AI healthcare app), I can tell you **what data you can safely keep in Bubble vs. what needs to stay outside it**, and suggest a HIPAA-compliant architecture.

For a small healthcare practice, I’d choose the vendor as if you were buying a **security-critical healthcare system**, not just hiring a web-development shop. “HIPAA compliant” is not a product feature that a vendor can simply certify for you; HIPAA compliance depends on the entire system, configuration, contracts, policies, and how your practice uses it. HHS specifically says OCR does **not** certify or endorse particular technologies or products. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 1. Start with your requirements—not vendor pitches Define exactly what the portal needs to do: - Patient registration/intake and forms - Secure messaging - Appointment requests/scheduling - Document exchange - Lab/result delivery - Payments or billing - Telehealth, if applicable - Integration with your EHR/EMR - Staff/admin portal - Patient identity verification and password recovery - Audit trail - Data export and migration Also identify **what PHI the portal will create, receive, maintain, or transmit**. That determines which vendors and subcontractors become business associates. ### 2. Make a BAA a non-negotiable requirement If the vendor will handle ePHI on your behalf, you generally need a HIPAA-compliant **Business Associate Agreement (BAA)** with that vendor. HHS explicitly says this applies to cloud providers that create, receive, maintain, or transmit ePHI—even if the data is encrypted and the provider doesn't possess the decryption key. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Ask every candidate: > “Will you execute your BAA before we put any PHI into the system?” A vendor saying *“our platform is HIPAA compliant, so you don't need a BAA”* should be a major red flag if they are actually handling your PHI. Also ask who their **subcontractors/sub-processors** are and whether they will be covered appropriately. HHS's sample BAA provisions specifically address subcontractors that have access to PHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 3. Evaluate security architecture in detail Don't accept “bank-level security” or “HIPAA-ready” as an answer. Ask the vendor to explain: | Area | What I'd want to see | |---|---| | Encryption | Encryption in transit and at rest | | Authentication | MFA, strong password controls, secure account recovery | | Authorization | Role-based access; least privilege | | Audit logging | Who accessed/changed what, when, and from where | | Admin access | Strong controls around vendor personnel with production access | | Backups | Encrypted, tested, documented recovery | | Disaster recovery | RTO/RPO and recovery testing | | Vulnerability management | Patching, scanning, penetration testing | | Monitoring | Detection and response to suspicious activity | | Development | Secure SDLC, code review, dependency management | | Data isolation | Logical separation between practices/customers | | Data deletion | What happens when your contract ends | | Data export | Ability to retrieve your complete data | HHS emphasizes that risk analysis is foundational to selecting and implementing appropriate safeguards, and that security measures should be appropriate to the organization's size, infrastructure, costs, and risks. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Ask for evidence, not promises For your finalists, request: - SOC 2 Type II report, if available - Recent penetration-test summary - Security architecture/overview - Incident-response policy or summary - Business continuity/disaster-recovery documentation - Encryption details - List of subprocessors - Data-center/cloud-provider information - Uptime history/SLA - BAA - Cybersecurity insurance information - References from **small healthcare practices** You don't necessarily need every vendor to hand over its entire security program. But a vendor unwilling to provide *any* meaningful evidence should concern you. HHS notes that HIPAA doesn't automatically require a CSP to give customers security documentation or audit rights, but customers can negotiate additional assurances based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 5. Pay particular attention to the contract The BAA shouldn't be the only document you review. Your services agreement/SLA should address things like: - Uptime and support response times - Security responsibilities of each party - Breach/incident notification - Backup and disaster recovery - Data ownership - Data retention - Data return/export - Data destruction after termination - Vendor access to your data - Subcontractors - Termination rights - Liability/indemnification - Cyber insurance HHS specifically identifies availability, backup/recovery, data return, security responsibilities, and retention/disclosure restrictions as issues that can be addressed in an SLA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 6. Be especially careful if you're hiring a custom-development firm If you're **building a portal from scratch**, I'd put substantially more weight on the development team's security maturity than on their portfolio. Ask: 1. Who owns the source code? 2. Where is production hosted? 3. Which cloud services are being used? 4. Which of those providers will sign BAAs? 5. Who has production database access? 6. How is PHI prevented from appearing in developer/test environments? 7. Is PHI ever copied into local developer machines? 8. How are secrets/API keys managed? 9. What is the authentication architecture? 10. How are authorization rules tested? 11. What happens when an employee leaves? 12. Is there independent penetration testing before launch? 13. How are vulnerabilities reported and fixed? 14. What happens if the developer goes out of business? 15. Can another developer take over the system? I'd be particularly wary of a small development shop that says, essentially, **“We'll make the website HIPAA compliant.”** Building a secure healthcare application requires considerably more than adding HTTPS and a login page. ### 7. Score vendors instead of choosing by gut feeling I'd use a weighted scorecard something like: - **Security architecture & controls — 25%** - **HIPAA/BAA & compliance maturity — 20%** - **Healthcare experience — 15%** - **Functionality/workflow fit — 15%** - **EHR/integration capabilities — 10%** - **Reliability/support — 5%** - **Total cost of ownership — 5%** - **Vendor viability/data portability — 5%** Don't let a vendor win because it's $10,000 cheaper if its security evidence, contract, or exit strategy is substantially worse. ### 8. Run a realistic demo Don't let them give you a generic sales demo. Give each finalist the **same patient journey**: > New patient → creates account → completes intake → uploads ID/document → sends secure message → receives a document → staff member accesses it → another staff member with different permissions attempts access → patient closes account. Ask the vendor to demonstrate each step and show **what gets logged**. That exposes weaknesses in authentication, authorization, workflow, audit logging, patient experience, and staff administration much faster than a feature checklist. ### 9. Don't overlook the practice's responsibilities Even with an excellent vendor, your practice remains responsible for its own HIPAA compliance. For example, if the vendor contract says your practice controls certain authentication/security functions and your practice fails to configure them appropriately, that can matter in an OCR investigation. HHS explicitly emphasizes understanding which security responsibilities belong to the customer versus the cloud provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) I'd therefore budget for a **HIPAA/security risk assessment before launch**, rather than assuming the vendor's BAA makes the portal compliant. HHS provides a Security Risk Assessment resource specifically intended to help small and medium-sized practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### The biggest red flags I'd eliminate or seriously downgrade a vendor that: - Won't sign a BAA - Can't explain where PHI is stored - Can't identify its subprocessors - Has no meaningful audit logging - Doesn't support MFA - Gives developers unrestricted production access - Uses production PHI in development/testing - Can't explain backup/recovery - Has no documented incident-response process - Won't provide reasonable security evidence - Has vague data-deletion/export terms - Claims “HIPAA certification” as its primary security evidence - Is dramatically cheaper because security work is being treated as an afterthought **One final point:** don't make “HIPAA compliant” your primary vendor-selection criterion. Make **“Can this vendor demonstrate that the system, contracts, controls, and operating model appropriately address our identified risks?”** the criterion. That's much closer to how HHS frames the Security Rule. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you're actually evaluating vendors now, I can also give you a **one-page vendor RFP/questionnaire with ~30 questions and a scoring rubric** that you can send to prospective portal developers. | Area | What I'd want to see | |---|---| | Encryption | Encryption in transit and at rest | | Authentication | MFA, strong password controls, secure account recovery | | Authorization | Role-based access; least privilege | | Audit logging | Who accessed/changed what, when, and from where | | Admin access | Strong controls around vendor personnel with production access | | Backups | Encrypted, tested, documented recovery | | Disaster recovery | RTO/RPO and recovery testing | | Vulnerability management | Patching, scanning, penetration testing | | Monitoring | Detection and response to suspicious activity | | Development | Secure SDLC, code review, dependency management | | Data isolation | Logical separation between practices/customers | | Data deletion | What happens when your contract ends | | Data export | Ability to retrieve your complete data | HHS emphasizes that risk analysis is foundational to selecting and implementing appropriate safeguards, and that security measures should be appropriate to the organization's size, infrastructure, costs, and risks. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### 4. Ask for evidence, not promises For your finalists, request: - SOC 2 Type II report, if available - Recent penetration-test summary - Security architecture/overview - Incident-response policy or summary - Business continuity/disaster-recovery documentation - Encryption details - List of subprocessors - Data-center/cloud-provider information - Uptime history/SLA - BAA - Cybersecurity insurance information - References from **small healthcare practices** You don't necessarily need every vendor to hand over its entire security program. But a vendor unwilling to provide *any* meaningful evidence should concern you. HHS notes that HIPAA doesn't automatically require a CSP to give customers security documentation or audit rights, but customers can negotiate additional assurances based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ### 5. Pay particular attention to the contract The BAA shouldn't be the only document you review. Your services agreement/SLA should address things like: - Uptime and support response times - Security responsibilities of each party - Breach/incident notification - Backup and disaster recovery - Data ownership - Data retention - Data return/export - Data destruction after termination - Vendor access to your data - Subcontractors - Termination rights - Liability/indemnification - Cyber insurance HHS specifically identifies availability, backup/recovery, data return, security responsibilities, and retention/disclosure restrictions as issues that can be addressed in an SLA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### 6. Be especially careful if you're hiring a custom-development firm If you're **building a portal from scratch**, I'd put substantially more weight on the development team's security maturity than on their portfolio. Ask: 1. Who owns the source code? 2. Where is production hosted? 3. Which cloud services are being used? 4. Which of those providers will sign BAAs? 5. Who has production database access? 6. How is PHI prevented from appearing in developer/test environments? 7. Is PHI ever copied into local developer machines? 8. How are secrets/API keys managed? 9. What is the authentication architecture? 10. How are authorization rules tested? 11. What happens when an employee leaves? 12. Is there independent penetration testing before launch? 13. How are vulnerabilities reported and fixed? 14. What happens if the developer goes out of business? 15. Can another developer take over the system? I'd be particularly wary of a small development shop that says, essentially, **“We'll make the website HIPAA compliant.”** Building a secure healthcare application requires considerably more than adding HTTPS and a login page. ### 7. Score vendors instead of choosing by gut feeling I'd use a weighted scorecard something like: - **Security architecture & controls — 25%** - **HIPAA/BAA & compliance maturity — 20%** - **Healthcare experience — 15%** - **Functionality/workflow fit — 15%** - **EHR/integration capabilities — 10%** - **Reliability/support — 5%** - **Total cost of ownership — 5%** - **Vendor viability/data portability — 5%** Don't let a vendor win because it's $10,000 cheaper if its security evidence, contract, or exit strategy is substantially worse. ### 8. Run a realistic demo Don't let them give you a generic sales demo. Give each finalist the **same patient journey**: > New patient → creates account → completes intake → uploads ID/document → sends secure message → receives a document → staff member accesses it → another staff member with different permissions attempts access → patient closes account. Ask the vendor to demonstrate each step and show **what gets logged**. That exposes weaknesses in authentication, authorization, workflow, audit logging, patient experience, and staff administration much faster than a feature checklist. ### 9. Don't overlook the practice's responsibilities Even with an excellent vendor, your practice remains responsible for its own HIPAA compliance. For example, if the vendor contract says your practice controls certain authentication/security functions and your practice fails to configure them appropriately, that can matter in an OCR investigation. HHS explicitly emphasizes understanding which security responsibilities belong to the customer versus the cloud provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) I'd therefore budget for a **HIPAA/security risk assessment before launch**, rather than assuming the vendor's BAA makes the portal compliant. HHS provides a Security Risk Assessment resource specifically intended to help small and medium-sized practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### The biggest red flags I'd eliminate or seriously downgrade a vendor that: - Won't sign a BAA - Can't explain where PHI is stored - Can't identify its subprocessors - Has no meaningful audit logging - Doesn't support MFA - Gives developers unrestricted production access - Uses production PHI in development/testing - Can't explain backup/recovery - Has no documented incident-response process - Won't provide reasonable security evidence - Has vague data-deletion/export terms - Claims “HIPAA certification” as its primary security evidence - Is dramatically cheaper because security work is being treated as an afterthought **One final point:** don't make “HIPAA compliant” your primary vendor-selection criterion. Make **“Can this vendor demonstrate that the system, contracts, controls, and operating model appropriately address our identified risks?”** the criterion. That's much closer to how HHS frames the Security Rule. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you're actually evaluating vendors now, I can also give you a **one-page vendor RFP/questionnaire with ~30 questions and a scoring rubric** that you can send to prospective portal developers.

Yes. You can build a HIPAA-compliant client portal **without writing code**, but the important distinction is that **“HIPAA-compliant” is not a feature you turn on**. Your software, configuration, vendors, contracts, policies, and operating procedures all have to fit together. HHS says the first step is an accurate, documented risk analysis covering the ePHI you create, receive, maintain, or transmit. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ### A practical no-code architecture I'd build it with these components: 1. **HIPAA-capable portal platform** - Patient/client login - Secure messaging - Document upload/download - Forms/intake questionnaires - Appointment or task notifications - Staff/admin dashboard - Audit logging - Role-based permissions 2. **A vendor that will actually sign a BAA** This is critical. If a cloud service creates, receives, maintains, or transmits ePHI for you, HHS says you generally need a HIPAA-compliant Business Associate Agreement with that provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) 3. **Separate your public website from the PHI environment** Your marketing site can be ordinary. The portal should be a separate authenticated environment where PHI lives. 4. **Use secure authentication** - Unique accounts for each client - Strong passwords - MFA for staff, preferably clients too - Automatic session expiration - Role-based access - No shared staff accounts 5. **Keep PHI out of ordinary email/SMS** Instead of emailing `"Your lab results are ready: [link]"` with sensitive information, send a generic notification directing the client to the authenticated portal. 6. **Configure minimum necessary access** For example: | User | Can see | |---|---| | Client | Their own records | | Clinician | Assigned clients | | Billing | Billing-related information | | Admin | Operational information necessary for their job | | Super admin | Carefully controlled administrative access | 7. **Turn on logging and backups** You want to be able to determine who accessed or changed information and when, and you need an appropriate backup/recovery strategy. ### The easiest no-code approach Rather than assembling 8–10 generic SaaS products, I'd strongly favor a **single healthcare-oriented portal platform that explicitly supports HIPAA and offers a BAA**. That reduces the number of vendors you have to evaluate and the number of integrations where PHI could accidentally leak. A typical no-code workflow could look like: **Client → Portal login → Intake form → Secure database → Staff notification → Staff review → Secure message/document → Client portal** You can build the workflow with visual form builders, databases, automations, and permissions rather than programming. ### Don't make this mistake A vendor saying **“HIPAA compliant”** on its website isn't sufficient by itself. Before putting real PHI into it, ask: - Will you sign a BAA? - Which specific services are covered by the BAA? - Is PHI encrypted in transit and at rest? - Are audit logs available? - Is MFA supported? - Can I enforce role-based access? - How are backups handled? - What happens to PHI when I terminate the account? - Do your subprocessors have appropriate agreements? - Can I export my data? - How are security incidents/breaches reported? HHS specifically notes that customers can require additional assurances or security documentation from cloud providers based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) And remember: **a BAA doesn't magically make your implementation compliant.** Your organization still has its own HIPAA obligations and must perform its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### If I were building one from scratch I'd use this sequence: **Phase 1 — Requirements** - Decide exactly what PHI the portal will handle. - Identify clients, staff, administrators, and their permissions. - Map where every piece of PHI enters, travels, and gets stored. **Phase 2 — Platform** - Select a no-code healthcare/portal platform. - Verify its current HIPAA capabilities. - Execute the BAA **before** entering production PHI. **Phase 3 — Build** - Client registration/login - Consent/intake - Secure messaging - Document exchange - Staff dashboard - Notifications - Roles/permissions - Audit trail **Phase 4 — Security** - MFA - Least-privilege permissions - Session controls - Backups - Device/account policies - Incident-response procedures **Phase 5 — Compliance** - Perform and document your risk analysis. - Document policies and procedures. - Test access controls. - Test backup/recovery. - Establish breach/incident procedures. - Train personnel. - Reassess periodically. HHS explicitly describes risk analysis as an **ongoing process**, rather than a one-time checkbox. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you tell me **what kind of business this is (therapy, medical practice, dental, legal, home health, etc.) and roughly how many clients/staff you expect**, I can recommend a **specific no-code stack and architecture**, including which platforms to evaluate and what the monthly cost would likely look like. | User | Can see | |---|---| | Client | Their own records | | Clinician | Assigned clients | | Billing | Billing-related information | | Admin | Operational information necessary for their job | | Super admin | Carefully controlled administrative access | 7. **Turn on logging and backups** You want to be able to determine who accessed or changed information and when, and you need an appropriate backup/recovery strategy. ### The easiest no-code approach Rather than assembling 8–10 generic SaaS products, I'd strongly favor a **single healthcare-oriented portal platform that explicitly supports HIPAA and offers a BAA**. That reduces the number of vendors you have to evaluate and the number of integrations where PHI could accidentally leak. A typical no-code workflow could look like: **Client → Portal login → Intake form → Secure database → Staff notification → Staff review → Secure message/document → Client portal** You can build the workflow with visual form builders, databases, automations, and permissions rather than programming. ### Don't make this mistake A vendor saying **“HIPAA compliant”** on its website isn't sufficient by itself. Before putting real PHI into it, ask: - Will you sign a BAA? - Which specific services are covered by the BAA? - Is PHI encrypted in transit and at rest? - Are audit logs available? - Is MFA supported? - Can I enforce role-based access? - How are backups handled? - What happens to PHI when I terminate the account? - Do your subprocessors have appropriate agreements? - Can I export my data? - How are security incidents/breaches reported? HHS specifically notes that customers can require additional assurances or security documentation from cloud providers based on their own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) And remember: **a BAA doesn't magically make your implementation compliant.** Your organization still has its own HIPAA obligations and must perform its own risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### If I were building one from scratch I'd use this sequence: **Phase 1 — Requirements** - Decide exactly what PHI the portal will handle. - Identify clients, staff, administrators, and their permissions. - Map where every piece of PHI enters, travels, and gets stored. **Phase 2 — Platform** - Select a no-code healthcare/portal platform. - Verify its current HIPAA capabilities. - Execute the BAA **before** entering production PHI. **Phase 3 — Build** - Client registration/login - Consent/intake - Secure messaging - Document exchange - Staff dashboard - Notifications - Roles/permissions - Audit trail **Phase 4 — Security** - MFA - Least-privilege permissions - Session controls - Backups - Device/account policies - Incident-response procedures **Phase 5 — Compliance** - Perform and document your risk analysis. - Document policies and procedures. - Test access controls. - Test backup/recovery. - Establish breach/incident procedures. - Train personnel. - Reassess periodically. HHS explicitly describes risk analysis as an **ongoing process**, rather than a one-time checkbox. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) If you tell me **what kind of business this is (therapy, medical practice, dental, legal, home health, etc.) and roughly how many clients/staff you expect**, I can recommend a **specific no-code stack and architecture**, including which platforms to evaluate and what the monthly cost would likely look like.

Yes. **A no-code front end can absolutely sit on top of a HIPAA-compliant backend**—but the important question is whether the *entire data flow* is HIPAA-appropriate, not whether the frontend itself is marketed as “no-code.” A typical architecture can look like: **No-code frontend → API → HIPAA-capable backend/database → other healthcare services** The key requirements are: - **The frontend must not send PHI to an unapproved service.** If your no-code platform receives, stores, logs, or processes PHI, it may itself be a business associate and generally needs a BAA. HHS says cloud providers handling ePHI on behalf of a covered entity/business associate are business associates, including when the data is encrypted. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com) - **Your backend/cloud providers need appropriate BAAs** where they handle ePHI. A BAA alone isn't sufficient—you still need appropriate safeguards and a risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) - **Be careful with frontend analytics and integrations.** Things like Google Analytics, session replay, error tracking, email/SMS services, and automation platforms can accidentally receive PHI. - **Authentication and authorization need to be designed properly.** Don't rely solely on the no-code platform's user/login system if your backend contains sensitive patient data. - **Keep PHI out of URLs, browser storage, logs, and error messages** unless you've specifically designed those components for HIPAA requirements. - **You don't necessarily need a “HIPAA-certified” frontend.** HHS does not certify or endorse particular technologies/products as HIPAA compliant. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=chatgpt.com) ### A good approach If you're building something like a patient portal, clinician dashboard, intake application, or healthcare SaaS, I'd generally favor: **No-code UI** → **authenticated API** → **HIPAA-capable backend** → **HIPAA-capable database/storage** That lets you use no-code for the presentation layer while keeping the sensitive data and business logic behind a controlled API. If you tell me **which no-code frontend you're considering** (e.g. Bubble, WeWeb, FlutterFlow, Retool, Softr, Webflow, etc.) and **which backend** (Supabase, Firebase, AWS, Azure, custom API, etc.), I can tell you whether that particular combination can realistically be configured for HIPAA and where the compliance traps are.

Yes — **Knack offers a HIPAA-compliant version of its platform**, called **Knack Health**. However, there’s an important distinction: **using Knack does not automatically make your application HIPAA compliant**. According to Knack’s current documentation: - **Knack Health has HIPAA-ready hosting** and security controls, including encryption in transit/at rest, role-based access, audit/change logs, 2FA, and other safeguards. [www.knack.com](https://www.knack.com/health/hipaa/?utm_source=chatgpt.com) - **Knack provides a Business Associate Agreement (BAA)** for customers on its HIPAA plans. The BAA needs to be in place **before you store PHI**. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com)[docs.knack.com](https://docs.knack.com/v3/docs/knack-health-hipaa-plans?utm_source=chatgpt.com) - **Regular/free-trial Knack isn't sufficient for PHI.** Knack specifically says not to put PHI into a trial environment and that you need a HIPAA plan and signed BAA. [docs.knack.com](https://docs.knack.com/docs/business-associate-agreements?utm_source=chatgpt.com)[docs.knack.com](https://docs.knack.com/v3/docs/knack-health-hipaa-plans?utm_source=chatgpt.com) - **Your integrations matter.** If PHI leaves Knack through an API, Flow, webhook, email service, Google Sheets, CRM, etc., that third party also needs to be appropriately HIPAA compliant and have a BAA where required. [docs.knack.com](https://docs.knack.com/docs/flows-and-third-party-compliance?utm_source=chatgpt.com) - Knack describes HIPAA compliance as a **shared responsibility**: they secure the platform, while you are responsible for configuring the application, controlling access, handling PHI appropriately, and maintaining your organization's HIPAA policies and procedures. [docs.knack.com](https://docs.knack.com/docs/your-responsibilities-as-a-covered-entity?utm_source=chatgpt.com) So if you're evaluating Knack for something like **patient records, intake forms, case management, or another application containing PHI**, the answer is **yes, it can be used in a HIPAA-compliant setup—but you need the appropriate Knack Health HIPAA plan + BAA and a compliant application configuration.** If you tell me **what you're planning to store/do in Knack**, I can also tell you whether your specific setup would likely satisfy HIPAA requirements and flag the risky pieces (forms, email, integrations, file uploads, AI, etc.).

Yes. **A no-code front end can absolutely be used with a HIPAA-compliant backend**, but the key is that the *entire data flow* must be designed for HIPAA—not just the database. HHS explicitly allows cloud services to store/process ePHI when the appropriate **Business Associate Agreement (BAA)** is in place and the applicable HIPAA safeguards are met. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)  ### A typical architecture You could have: **No-code frontend** → HTTPS/API → **HIPAA-capable backend** → **HIPAA-capable database/storage** For example: - **Frontend:** a no-code/low-code app builder - **Authentication:** secure authentication provider - **Backend/API:** a HIPAA-capable cloud service - **Database:** encrypted database with appropriate access controls - **Files:** HIPAA-capable object storage - **Logging:** audit logs of access/changes - **AI, email, analytics, payments, etc.:** each vendor evaluated separately if PHI touches them The important question isn't whether the frontend is "no-code." It's **whether the frontend or any service it uses handles PHI, and whether those vendors will support your HIPAA obligations and execute BAAs where required.** ### The big catch Suppose your no-code frontend sends: > Patient name + DOB + diagnosis → backend Even if your backend is perfectly HIPAA-ready, the no-code platform may itself be receiving PHI. In that case, you can't simply assume the backend's HIPAA compliance protects you. HHS says a cloud provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity/business associate can be a business associate, even if the data is encrypted and the provider can't read it. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) So you generally want either: **Option A — HIPAA-capable no-code frontend** `No-code UI → HIPAA-capable API/backend → database` or **Option B — Keep PHI out of the no-code platform** `No-code UI → your controlled API → HIPAA backend` In Option B, the no-code layer might only deal with things like a random patient ID/token, while the backend handles the actual PHI. ### What I'd look for in a no-code platform Before choosing one, ask: 1. **Will you sign a BAA?** 2. Does the platform itself process/store PHI? 3. Where is data stored? 4. Is data encrypted in transit and at rest? 5. Does it provide appropriate access controls/RBAC? 6. Does it provide audit logging? 7. Can you prevent PHI from being sent to analytics/error-reporting systems? 8. Do its subprocessors also support the required HIPAA arrangements? 9. Can you control data retention/deletion? 10. Does the architecture let you perform your required risk analysis? And importantly, **"HIPAA compliant" isn't a certification that HHS gives a particular product**. HHS specifically says OCR does not endorse or certify particular technologies/products as HIPAA compliant. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=chatgpt.com) If you're thinking about building a specific app, tell me **which no-code frontend you're considering (e.g. Bubble, WeWeb, FlutterFlow, Softr, Retool, etc.) and which backend/database**, and I can map out a HIPAA-safe architecture and identify where the potential compliance gaps are.

Yes. For **service businesses**—agencies, consultants, accounting firms, managed services, home services, professional services, etc.—I’d shortlist these: | Platform | Best for | Client portals | Internal dashboards | Customization | Technical difficulty | |---|---|---:|---:|---:|---:| | **Softr** | Best overall | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low | | **Glide** | Fast operational apps | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low | | **Stacker** | Data-heavy portals | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low–Medium | | **Retool** | Complex internal operations | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | Medium–High | | **Bubble** | Highly custom applications | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | High | | **Power Apps** | Microsoft-heavy businesses | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Medium–High | ### 🥇 1. Softr — best overall My default recommendation for a service business. You can build **one application with different experiences for clients, employees, managers, and admins**. It supports authentication, granular permissions, forms, documents, dashboards, workflows, and integrations with databases/CRMs. [www.softr.io](https://www.softr.io/use-cases/portals?utm_source=chatgpt.com) It's particularly good for things like: - Client onboarding - Project/status portals - Client-specific dashboards - Document collection - Approvals - Reporting - Invoices/payment visibility - Internal operations dashboards - Employee/client request forms Softr can connect to sources such as Airtable, Google Sheets, HubSpot, SQL databases, Postgres, Supabase, and REST APIs. [www.softr.io](https://www.softr.io/create/client-portal-system?utm_source=chatgpt.com) [Softr](https://www.softr.io/?utm_source=chatgpt.com) **I'd pick it if:** you want something that feels like a **custom SaaS portal without actually building SaaS from scratch**. --- ### 🥈 2. Glide — best for speed Glide is excellent when your business already lives in **Google Sheets, spreadsheets, or structured operational data**. It can create customer, employee, supplier, and partner portals, as well as dashboards and operational apps. [www.glideapps.com](https://www.glideapps.com/use-cases/portals?utm_source=chatgpt.com) The UX is generally very quick to build, making it attractive for: > "We need an internal scheduling/dispatch/project-management app next week." rather than: > "We need to build a sophisticated client-facing software product." [Glide](https://www.glideapps.com/?utm_source=chatgpt.com) **I'd pick it if:** speed and simplicity matter more than having absolute control over the application. --- ### 🥉 3. Stacker — excellent for data-driven portals Stacker is interesting when the underlying business data is the centerpiece. It supports **customer portals, internal workspaces, permissions, external users, workflows, and connections to systems such as Salesforce, Stripe, HubSpot, and Airtable**. [stacker.ai](https://stacker.ai/docs?utm_source=chatgpt.com) It's a particularly good fit for a service company with something like: **CRM → Jobs → Clients → Employees → Documents → Billing → Reporting** where different people need different views of the same underlying data. [Stacker](https://stacker.ai/?utm_source=chatgpt.com) --- ### 4. Retool — best for serious internal dashboards Retool is the one I'd look at when the **internal operations side** is much more sophisticated than the client portal. It connects directly to databases and APIs and is designed for admin panels, CRUD interfaces, dashboards, operational tools, and workflow automation. [retool.com](https://retool.com/use-cases?utm_source=chatgpt.com) Think: - Dispatch dashboard - Operations control center - Employee management - Financial operations - Database administration - Complex workflow tooling - Multi-system integrations It also provides more developer-oriented control than Softr or Glide. [retool.com](https://retool.com/for/engineering-teams?utm_source=chatgpt.com) [Retool](https://retool.com/?utm_source=chatgpt.com) **I'd pick it if:** you have a technical person/team and the app needs to interact heavily with APIs and databases. --- ### 5. Bubble — maximum customization Bubble is closer to building a **real custom web application**. You can create highly bespoke workflows, UI, database structures, user roles, payments, automations, and business logic. The tradeoff is that it's substantially more involved to build and maintain than Softr or Glide. [www.softr.io](https://www.softr.io/blog/glide-vs-bubble?utm_source=chatgpt.com) [Bubble](https://bubble.io/?utm_source=chatgpt.com) **I'd pick it if:** you're effectively building a proprietary software product rather than simply digitizing operations. --- ### My ranking specifically for service businesses **If you're building both client portal + internal dashboard:** 1. **Softr** — ⭐⭐⭐⭐⭐ 2. **Glide** — ⭐⭐⭐⭐½ 3. **Stacker** — ⭐⭐⭐⭐½ 4. **Retool** — ⭐⭐⭐⭐ 5. **Bubble** — ⭐⭐⭐⭐ 6. **Power Apps** — ⭐⭐⭐½ The big distinction is **who the users are**. **External clients + internal staff → Softr / Stacker** **Mostly internal staff → Retool / Glide** **Spreadsheet-driven business → Glide** **Database-heavy business → Stacker / Retool** **Highly bespoke software product → Bubble** **Microsoft 365/Teams/SharePoint ecosystem → Power Apps** ### What I'd build for a typical service business I'd probably structure it as: ```text CUSTOM PORTAL │ ┌──────────────┴──────────────┐ │ │ CLIENT LOGIN STAFF LOGIN │ │ ┌──────┼──────┐ ┌───────┼────────┐ │ │ │ │ │ │ Projects Files Billing Jobs Tasks Reporting │ │ │ │ │ │ └──────┴──────┘ └───────┴────────┘ │ │ └────────── DATABASE ─────────┘ │ CRM / Accounting / Scheduling / etc. ``` **Softr is probably the strongest starting point for this exact architecture.** It is explicitly positioned around combining client portals, employee portals, dashboards, forms, documents, and internal tools in the same application. [www.softr.io](https://www.softr.io/use-cases/portals?utm_source=chatgpt.com) If you tell me **what type of service business** you're building this for (e.g. agency, law firm, accounting, HVAC, cleaning, consulting, MSP, construction), I can narrow this down to the **best 2–3 platforms and the exact portal/dashboard architecture I'd use**. [Softr](https://www.softr.io/?utm_source=chatgpt.com) [Glide](https://www.glideapps.com/?utm_source=chatgpt.com) [Stacker](https://stacker.ai/?utm_source=chatgpt.com) [Retool](https://retool.com/?utm_source=chatgpt.com) [Bubble](https://bubble.io/?utm_source=chatgpt.com) Softr Glide Retool Bubble Yes. For **service businesses**—agencies, consultants, accounting firms, managed services, home services, professional services, etc.—I’d shortlist these: | Platform | Best for | Client portals | Internal dashboards | Customization | Technical difficulty | |---|---|---:|---:|---:|---:| | **Softr** | Best overall | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low | | **Glide** | Fast operational apps | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low | | **Stacker** | Data-heavy portals | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Low–Medium | | **Retool** | Complex internal operations | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | Medium–High | | **Bubble** | Highly custom applications | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | High | | **Power Apps** | Microsoft-heavy businesses | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | ⭐⭐⭐⭐ | Medium–High | ### 🥇 1. Softr — best overall My default recommendation for a service business. You can build **one application with different experiences for clients, employees, managers, and admins**. It supports authentication, granular permissions, forms, documents, dashboards, workflows, and integrations with databases/CRMs. [www.softr.io](https://www.softr.io/use-cases/portals?utm_source=chatgpt.com) It's particularly good for things like: - Client onboarding - Project/status portals - Client-specific dashboards - Document collection - Approvals - Reporting - Invoices/payment visibility - Internal operations dashboards - Employee/client request forms Softr can connect to sources such as Airtable, Google Sheets, HubSpot, SQL databases, Postgres, Supabase, and REST APIs. [www.softr.io](https://www.softr.io/create/client-portal-system?utm_source=chatgpt.com) [Softr](https://www.softr.io/?utm_source=chatgpt.com) **I'd pick it if:** you want something that feels like a **custom SaaS portal without actually building SaaS from scratch**. --- ### 🥈 2. Glide — best for speed Glide is excellent when your business already lives in **Google Sheets, spreadsheets, or structured operational data**. It can create customer, employee, supplier, and partner portals, as well as dashboards and operational apps. [www.glideapps.com](https://www.glideapps.com/use-cases/portals?utm_source=chatgpt.com) The UX is generally very quick to build, making it attractive for: > "We need an internal scheduling/dispatch/project-management app next week." rather than: > "We need to build a sophisticated client-facing software product." [Glide](https://www.glideapps.com/?utm_source=chatgpt.com) **I'd pick it if:** speed and simplicity matter more than having absolute control over the application. --- ### 🥉 3. Stacker — excellent for data-driven portals Stacker is interesting when the underlying business data is the centerpiece. It supports **customer portals, internal workspaces, permissions, external users, workflows, and connections to systems such as Salesforce, Stripe, HubSpot, and Airtable**. [stacker.ai](https://stacker.ai/docs?utm_source=chatgpt.com) It's a particularly good fit for a service company with something like: **CRM → Jobs → Clients → Employees → Documents → Billing → Reporting** where different people need different views of the same underlying data. [Stacker](https://stacker.ai/?utm_source=chatgpt.com) --- ### 4. Retool — best for serious internal dashboards Retool is the one I'd look at when the **internal operations side** is much more sophisticated than the client portal. It connects directly to databases and APIs and is designed for admin panels, CRUD interfaces, dashboards, operational tools, and workflow automation. [retool.com](https://retool.com/use-cases?utm_source=chatgpt.com) Think: - Dispatch dashboard - Operations control center - Employee management - Financial operations - Database administration - Complex workflow tooling - Multi-system integrations It also provides more developer-oriented control than Softr or Glide. [retool.com](https://retool.com/for/engineering-teams?utm_source=chatgpt.com) [Retool](https://retool.com/?utm_source=chatgpt.com) **I'd pick it if:** you have a technical person/team and the app needs to interact heavily with APIs and databases. --- ### 5. Bubble — maximum customization Bubble is closer to building a **real custom web application**. You can create highly bespoke workflows, UI, database structures, user roles, payments, automations, and business logic. The tradeoff is that it's substantially more involved to build and maintain than Softr or Glide. [www.softr.io](https://www.softr.io/blog/glide-vs-bubble?utm_source=chatgpt.com) [Bubble](https://bubble.io/?utm_source=chatgpt.com) **I'd pick it if:** you're effectively building a proprietary software product rather than simply digitizing operations. --- ### My ranking specifically for service businesses **If you're building both client portal + internal dashboard:** 1. **Softr** — ⭐⭐⭐⭐⭐ 2. **Glide** — ⭐⭐⭐⭐½ 3. **Stacker** — ⭐⭐⭐⭐½ 4. **Retool** — ⭐⭐⭐⭐ 5. **Bubble** — ⭐⭐⭐⭐ 6. **Power Apps** — ⭐⭐⭐½ The big distinction is **who the users are**. **External clients + internal staff → Softr / Stacker** **Mostly internal staff → Retool / Glide** **Spreadsheet-driven business → Glide** **Database-heavy business → Stacker / Retool** **Highly bespoke software product → Bubble** **Microsoft 365/Teams/SharePoint ecosystem → Power Apps** ### What I'd build for a typical service business I'd probably structure it as: ```text CUSTOM PORTAL │ ┌──────────────┴──────────────┐ │ │ CLIENT LOGIN STAFF LOGIN │ │ ┌──────┼──────┐ ┌───────┼────────┐ │ │ │ │ │ │ Projects Files Billing Jobs Tasks Reporting │ │ │ │ │ │ └──────┴──────┘ └───────┴────────┘ │ │ └────────── DATABASE ─────────┘ │ CRM / Accounting / Scheduling / etc. ``` **Softr is probably the strongest starting point for this exact architecture.** It is explicitly positioned around combining client portals, employee portals, dashboards, forms, documents, and internal tools in the same application. [www.softr.io](https://www.softr.io/use-cases/portals?utm_source=chatgpt.com) If you tell me **what type of service business** you're building this for (e.g. agency, law firm, accounting, HVAC, cleaning, consulting, MSP, construction), I can narrow this down to the **best 2–3 platforms and the exact portal/dashboard architecture I'd use**.

As of **August 13, 2026: no—not yet**. Bubble’s own documentation says that **the Bubble platform as a whole is currently not HIPAA compliant**, even though some of its underlying subprocessors may have HIPAA-capable infrastructure. Bubble therefore **does not recommend using Bubble for applications that require HIPAA compliance**. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) There is an important update, though: Bubble announced in 2026 that **HIPAA compliance is in progress**, with a target of **the second half of 2026**, and that it is expected to be an **Enterprise/dedicated-plan feature**. [bubble.io](https://bubble.io/blog/april-2026-founder-ama/?utm_source=chatgpt.com) ### What this means for you If you're building an app that will handle **PHI (protected health information)**: - **Today:** Don't assume a Bubble app is HIPAA compliant. - **Using AWS or another HIPAA-compliant backend:** This does **not automatically make the Bubble application HIPAA compliant**, because Bubble itself is part of the system handling the application/data. - **BAA:** You generally need appropriate **Business Associate Agreements** with vendors that handle PHI. Bubble's current documentation says its platform does not support HIPAA-compliant apps. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) - **Future:** Bubble appears to be working toward a HIPAA offering, but I'd wait until Bubble explicitly announces availability and provides the applicable **BAA, scope, controls, and Enterprise terms** before putting PHI into it. Bubble does currently advertise **SOC 2 Type II, encryption, security controls, and GDPR support**, but those are not equivalent to HIPAA compliance. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) [Bubble's HIPAA documentation](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) If you're considering Bubble for a **specific healthcare app**, tell me what kind of PHI it would handle and what your architecture looks like (Bubble database, Xano, Supabase, AWS, etc.), and I can tell you **whether there's a practical HIPAA-compliant architecture around Bubble or whether you should choose a different platform.** [Bubble's HIPAA documentation](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com)

Yes—you can build a **HIPAA-compliant client/patient portal without writing code**, but the important distinction is that **“HIPAA-compliant” applies to the entire system and your practices, not just the no-code platform**. HHS says you still need appropriate safeguards, a risk analysis, and BAAs with vendors that handle ePHI. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### The simplest no-code architecture For a small practice or healthcare business, I'd aim for: **Patient → secure portal → HIPAA-enabled forms/database → staff dashboard → secure messaging/files** A practical stack could be: 1. **Portal/interface:** A no-code platform that explicitly supports HIPAA and will sign a BAA. 2. **Forms:** [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) or [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) for intake forms, questionnaires, consents, uploads, etc. Jotform's HIPAA offering includes encrypted form data and a BAA; Formstack offers a HIPAA-oriented account with encryption and security controls. [www.jotform.com](https://www.jotform.com/hipaa/faq/?utm_source=chatgpt.com) 3. **Authentication:** Require individual patient accounts, strong passwords and MFA where supported. 4. **Documents:** Store records in a HIPAA-supported system—not ordinary Google Drive/Dropbox/etc. merely because those services have security features. 5. **Messaging:** Keep PHI inside the authenticated portal rather than ordinary email/SMS. 6. **Automation:** Only connect services that will sign a BAA **and** are configured to handle PHI appropriately. ### What I'd build first Your MVP could have these six screens: | Screen | Patient can… | |---|---| | **Dashboard** | See outstanding tasks and recent messages | | **My Profile** | Update contact/demographic information | | **Forms** | Complete intake, consent and questionnaires | | **Documents** | Upload/download documents | | **Messages** | Securely communicate with your staff | | **Appointments** | Request or manage appointments | Your staff side would have: - Patient directory - Patient-specific records - Form/submission review - Document management - Secure messaging - Appointment/task status - Audit/history information - Role-based access ### The critical HIPAA checklist Before putting real patient information into it: - [ ] Every vendor touching PHI has been evaluated. - [ ] You have a **BAA** with each applicable business associate. - [ ] The platform's HIPAA features are actually enabled—not just advertised. - [ ] Access is based on individual accounts and appropriate permissions. - [ ] PHI isn't being accidentally sent through email notifications, analytics, logs, forms, AI tools, etc. - [ ] Data is encrypted in transit and at rest as appropriate. - [ ] You have backups and a recovery process. - [ ] You have appropriate audit/access logging. - [ ] You have policies for access, retention, disposal and incident response. - [ ] You've performed and documented your HIPAA security risk analysis. HHS specifically notes that even a cloud provider storing **encrypted** ePHI can still be a business associate, so encryption by itself doesn't eliminate the need for a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I would *not* do I wouldn't start with **Bubble + Airtable + Zapier + Google Drive + Gmail** and assume that making the portal password-protected makes it HIPAA compliant. You have to trace **every place PHI travels and every vendor that can access it**. For a no-code build, the safest approach is usually to minimize the number of vendors and choose platforms that have an explicit HIPAA offering and BAA. If you tell me **what kind of client portal you're building** (e.g. therapist, medical practice, home healthcare, law firm handling medical records, billing company) and roughly **how many clients/users**, I can lay out a specific **$0–$500/month no-code stack and the exact build steps**. [Jotform](https://www.jotform.com/?utm_source=chatgpt.com) [Formstack](https://www.formstack.com/?utm_source=chatgpt.com) | Screen | Patient can… | |---|---| | **Dashboard** | See outstanding tasks and recent messages | | **My Profile** | Update contact/demographic information | | **Forms** | Complete intake, consent and questionnaires | | **Documents** | Upload/download documents | | **Messages** | Securely communicate with your staff | | **Appointments** | Request or manage appointments | Your staff side would have: - Patient directory - Patient-specific records - Form/submission review - Document management - Secure messaging - Appointment/task status - Audit/history information - Role-based access ### The critical HIPAA checklist Before putting real patient information into it: - [ ] Every vendor touching PHI has been evaluated. - [ ] You have a **BAA** with each applicable business associate. - [ ] The platform's HIPAA features are actually enabled—not just advertised. - [ ] Access is based on individual accounts and appropriate permissions. - [ ] PHI isn't being accidentally sent through email notifications, analytics, logs, forms, AI tools, etc. - [ ] Data is encrypted in transit and at rest as appropriate. - [ ] You have backups and a recovery process. - [ ] You have appropriate audit/access logging. - [ ] You have policies for access, retention, disposal and incident response. - [ ] You've performed and documented your HIPAA security risk analysis. HHS specifically notes that even a cloud provider storing **encrypted** ePHI can still be a business associate, so encryption by itself doesn't eliminate the need for a BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### What I would *not* do I wouldn't start with **Bubble + Airtable + Zapier + Google Drive + Gmail** and assume that making the portal password-protected makes it HIPAA compliant. You have to trace **every place PHI travels and every vendor that can access it**. For a no-code build, the safest approach is usually to minimize the number of vendors and choose platforms that have an explicit HIPAA offering and BAA. If you tell me **what kind of client portal you're building** (e.g. therapist, medical practice, home healthcare, law firm handling medical records, billing company) and roughly **how many clients/users**, I can lay out a specific **$0–$500/month no-code stack and the exact build steps**.

Yes. **A no-code frontend can absolutely sit on top of a HIPAA-compliant backend**. The important distinction is that **“HIPAA-compliant backend” does not automatically make the whole application HIPAA compliant**. A typical architecture can look like: **No-code frontend → API/auth layer → HIPAA-capable backend/database → other HIPAA-capable services** The key questions are: 1. **Does the frontend ever handle PHI?** If patient names, diagnoses, medical records, etc. pass through or are stored by the frontend platform, that platform may itself be a business associate and generally needs a BAA. HHS says vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity can be business associates. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html?hl=en&utm_source=chatgpt.com) 2. **Will every service that handles PHI sign a BAA?** HHS specifically says that a cloud provider handling ePHI on behalf of a covered entity/business associate requires a HIPAA-compliant BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) 3. **Where does the frontend code actually run?** One attractive approach is a no-code/low-code tool that **exports the frontend code**, then you host that code yourself in your HIPAA-controlled environment. This can keep the no-code platform out of the PHI path. 4. **Is security enforced by the backend rather than the UI?** Don't rely on the no-code frontend to decide who can see a patient's data. Authorization, tenant isolation, role-based access, audit logging, encryption, etc. should be enforced server-side. ### A good pattern For example: > **No-code UI** > ↓ HTTPS > **HIPAA-capable API/backend** > ↓ > **HIPAA-capable database/storage** The frontend can essentially be a pretty interface for the backend. Ideally it receives only the data the authenticated user is authorized to see. And remember: **HIPAA isn't a certification you can simply get from a backend vendor.** HHS explicitly says it does not certify or endorse particular products as “HIPAA compliant.” Your organization still has compliance responsibilities, including risk analysis and appropriate safeguards. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me **which no-code frontend you're considering (e.g. Bubble, WeWeb, FlutterFlow, Retool, Softr, Lovable, etc.) and which backend**, I can tell you whether that specific combination is a realistic HIPAA architecture and where the PHI boundary should be.

Yes. If you’re looking for someone to **build a Softr client portal for you**, I’d prioritize a developer/agency with proven experience in: - **Softr + Airtable/Softr Database/Supabase** - Client-specific logins and **granular permissions** - Custom dashboards and workflows - File/document sharing - Forms and onboarding - Stripe/payment integrations if needed - Make/Zapier/n8n automations - Custom branding and domain - Ongoing maintenance Softr is particularly well suited to client portals because it supports user groups, granular permissions, custom dashboards, files, forms, workflows, and multiple data sources. [www.softr.io](https://www.softr.io/create/client-portal-for-agencies?utm_source=chatgpt.com) ### I can find you 3–5 good developers If you tell me **what the portal needs to do** and roughly **what you want to spend**, I can search for specific Softr developers/agencies and compare them on experience, reviews, pricing, location, and relevant portfolio work. For example: > “I need a portal for a consulting business. Clients need to log in, see their projects, upload documents, view reports, and communicate with us. Budget $3–5k.” Then I can narrow it down to the best candidates rather than just giving you a generic freelancer list.

If you’re choosing specifically for a **client portal**, I’d generally pick **Softr for speed and simplicity** and **Bubble for maximum customization**. | | **Softr** | **Bubble** | |---|---|---| | Best for | Client portals, dashboards, internal tools | Complex custom web apps | | Build speed | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | | Ease of use | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | | Custom workflows | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | | UI flexibility | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | | Client login / permissions | Strong | Strong | | Database | Usually connects to external data sources | Built-in + external options | | Complex business logic | Limited compared with Bubble | Excellent | | Learning curve | Low | High | | Maintenance | Easier | More involved | | Best if non-technical | **Yes** | Sometimes | | Scaling complexity | Good for straightforward portals | Better for sophisticated apps | ### I'd choose Softr if your portal needs: - Client login and profiles - Different client-specific dashboards - Documents/files - Forms and submissions - Project/status tracking - Tables and dashboards - Appointment or request workflows - Basic payments/invoicing - A polished portal you want to launch quickly For example: **client → logs in → sees their projects → uploads/downloads files → submits a request → sees status → communicates with your team.** That's very much in Softr's sweet spot. ### I'd choose Bubble if you need: - Highly customized workflows - Complex calculations/business rules - Lots of conditional behavior - A custom CRM-like system - Sophisticated user roles and permissions - Real-time functionality - A portal that is effectively becoming a full SaaS application - Little reliance on external databases/services The key distinction is: > **Softr is better when the portal is primarily a user interface around your data. Bubble is better when the portal itself is the application.** ### My recommendation For a **typical agency/service-business client portal**, I'd start with **Softr**. You can get something usable substantially faster and avoid building infrastructure that you don't actually need. I'd move toward **Bubble** if you already know the portal will contain complicated application logic or eventually become a standalone SaaS product. If you tell me **what your client portal needs to do** (e.g. documents, messaging, invoices, project tracking, forms, Stripe, CRM integration, etc.), I can give you a much more definitive **Softr vs. Bubble recommendation and architecture**. If you’re choosing specifically for a **client portal**, I’d generally pick **Softr for speed and simplicity** and **Bubble for maximum customization**. | | **Softr** | **Bubble** | |---|---|---| | Best for | Client portals, dashboards, internal tools | Complex custom web apps | | Build speed | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | | Ease of use | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | | Custom workflows | ⭐⭐⭐ | ⭐⭐⭐⭐⭐ | | UI flexibility | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ | | Client login / permissions | Strong | Strong | | Database | Usually connects to external data sources | Built-in + external options | | Complex business logic | Limited compared with Bubble | Excellent | | Learning curve | Low | High | | Maintenance | Easier | More involved | | Best if non-technical | **Yes** | Sometimes | | Scaling complexity | Good for straightforward portals | Better for sophisticated apps | ### I'd choose Softr if your portal needs: - Client login and profiles - Different client-specific dashboards - Documents/files - Forms and submissions - Project/status tracking - Tables and dashboards - Appointment or request workflows - Basic payments/invoicing - A polished portal you want to launch quickly For example: **client → logs in → sees their projects → uploads/downloads files → submits a request → sees status → communicates with your team.** That's very much in Softr's sweet spot. ### I'd choose Bubble if you need: - Highly customized workflows - Complex calculations/business rules - Lots of conditional behavior - A custom CRM-like system - Sophisticated user roles and permissions - Real-time functionality - A portal that is effectively becoming a full SaaS application - Little reliance on external databases/services The key distinction is: > **Softr is better when the portal is primarily a user interface around your data. Bubble is better when the portal itself is the application.** ### My recommendation For a **typical agency/service-business client portal**, I'd start with **Softr**. You can get something usable substantially faster and avoid building infrastructure that you don't actually need. I'd move toward **Bubble** if you already know the portal will contain complicated application logic or eventually become a standalone SaaS product. If you tell me **what your client portal needs to do** (e.g. documents, messaging, invoices, project tracking, forms, Stripe, CRM integration, etc.), I can give you a much more definitive **Softr vs. Bubble recommendation and architecture**.

Yes. As of **August 2026**, there are several no-code/low-code platforms that will sign a HIPAA Business Associate Agreement (BAA). The important distinction is that **“HIPAA-capable” is not the same as “will sign a BAA for the plan you're buying.”** ### Strongest options | Platform | BAA? | Best fit | My take | |---|---|---|---| | **Caspio** | ✅ Yes | Full database-backed apps, portals, workflows | **Excellent choice** | | **Knack Health** | ✅ Yes | Healthcare apps, patient portals, operational systems | **Excellent choice** | | **Zoho Creator** | ✅ Yes | Custom business/healthcare apps | **Good value** | | **Microsoft Power Apps** | ✅ Yes* | Enterprises already using Microsoft/Dataverse | **Excellent for Microsoft shops** | | **Quickbase** | ✅ Yes | Enterprise operational workflows | **Good, but expensive** | | **Airtable** | ✅ Yes* | Lightweight databases/internal apps | **Good for simpler use cases** | | **Smartsheet** | ✅ Yes* | Workflow/project/operations apps | **Good for workflow-heavy use cases** | | **Formstack** | ✅ Yes | Forms, intake, documents, e-signatures | **Excellent for forms/workflows** | \*Typically requires the appropriate enterprise/HIPAA-covered plan or agreement. #### 1. Caspio Caspio is probably one of the first platforms I'd evaluate. Its **HIPAA Edition includes a signed BAA**, dedicated HIPAA environment, encryption, audit trails, and unlimited users. Current pricing shown by Caspio starts at **$800/month with a one-year term**. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) #### 2. Knack Health Knack now has a healthcare-specific product, **Knack Health**, with a signed BAA, encrypted storage/transmission, role-based permissions, and record-change logs. Its HIPAA plans are specifically designed for healthcare applications. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/) This is particularly interesting if you're building something like a **patient portal, care-management system, home-care application, intake system, or internal healthcare operations app**. #### 3. Zoho Creator Zoho Creator supports HIPAA workflows and allows customers to request its BAA. It has ePHI field designation, encryption, granular permissions, audit trails, and backups. [help.zoho.com](https://help.zoho.com/portal/en/kb/creator/security/hipaa/articles/zoho-creator-hipaa-compliance-guide?utm_source=chatgpt.com) [Zoho Creator HIPAA information](https://help.zoho.com/portal/en/kb/creator/security/hipaa/articles/zoho-creator-hipaa-compliance-guide) One caveat: **the BAA specifies which Zoho services are covered**, so don't assume every Zoho product/integration is automatically inside your HIPAA boundary. [www.zoho.com](https://www.zoho.com/hipaa.html?utm_source=chatgpt.com) #### 4. Microsoft Power Apps Microsoft Power Apps is another strong option if you're comfortable with the Microsoft ecosystem. Microsoft provides a HIPAA BAA covering its in-scope services, and Power Apps/Dataverse can be used to build custom applications. [learn.microsoft.com](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech?utm_source=chatgpt.com) [Microsoft HIPAA compliance documentation](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech) The downside is that Power Apps is more enterprise-oriented and can become complicated from a licensing/architecture standpoint. #### 5. Quickbase Quickbase supports HIPAA with a BAA, but HIPAA access is generally associated with its higher-tier/business engagements rather than the entry-level offering. [www.caspio.com](https://www.caspio.com/blog/best-quickbase-alternative-for-no-code-apps-2026/?utm_source=chatgpt.com) ### Platforms I'd be careful about **Bubble:** I would **not** use Bubble for an application that directly handles PHI. Bubble's own documentation currently says that the platform does **not** meet HIPAA requirements and that it does not support HIPAA-compliant apps. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Glide:** It's a popular no-code platform, but I wouldn't put it in the same "confirmed BAA + healthcare-specific infrastructure" bucket without getting written confirmation from Glide for your exact plan and use case. **Webflow:** Fine for a marketing site around a healthcare product, but don't treat Webflow itself as your PHI datastore. You can, for example, embed a BAA-backed Formstack form into a Webflow site. [webflow.com](https://webflow.com/integrations/formstack?utm_source=chatgpt.com) ### If you're building an actual healthcare product I'd narrow the field to: **Caspio → Knack Health → Power Apps → Zoho Creator** And I'd choose based on what you're building: - **Patient-facing/custom database app:** Caspio or Knack - **Healthcare-specific internal application:** Knack Health - **Microsoft enterprise environment:** Power Apps + Dataverse - **Budget-conscious custom app:** Zoho Creator - **Forms/intake/e-signatures:** Formstack - **Complex enterprise operations:** Quickbase One crucial point: **the BAA is only one piece of HIPAA compliance.** Your integrations, email provider, analytics, file storage, authentication, AI services, and other subprocessors that touch PHI may each need appropriate HIPAA coverage/BAAs as well. Formstack, for example, explicitly warns that the customer remains responsible for compliance across the entire workflow and integrations. [help.formstack.com](https://help.formstack.com/hc/en-us/articles/44593118493843-Maintaining-HIPAA-Compliance-with-Formstack?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, SaaS healthcare app, intake form, CRM, scheduling system, home-care app), I can narrow this down to the **3 best platforms and compare their approximate costs, BAA requirements, database capabilities, APIs, and limitations**. [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) [Knack Health](https://www.knack.com/health/) [Zoho Creator HIPAA information](https://help.zoho.com/portal/en/kb/creator/security/hipaa/articles/zoho-creator-hipaa-compliance-guide) [Microsoft HIPAA compliance documentation](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech) Caspio Knack Zoho Microsoft Power Apps | Platform | BAA? | Best fit | My take | |---|---|---|---| | **Caspio** | ✅ Yes | Full database-backed apps, portals, workflows | **Excellent choice** | | **Knack Health** | ✅ Yes | Healthcare apps, patient portals, operational systems | **Excellent choice** | | **Zoho Creator** | ✅ Yes | Custom business/healthcare apps | **Good value** | | **Microsoft Power Apps** | ✅ Yes* | Enterprises already using Microsoft/Dataverse | **Excellent for Microsoft shops** | | **Quickbase** | ✅ Yes | Enterprise operational workflows | **Good, but expensive** | | **Airtable** | ✅ Yes* | Lightweight databases/internal apps | **Good for simpler use cases** | | **Smartsheet** | ✅ Yes* | Workflow/project/operations apps | **Good for workflow-heavy use cases** | | **Formstack** | ✅ Yes | Forms, intake, documents, e-signatures | **Excellent for forms/workflows** | \*Typically requires the appropriate enterprise/HIPAA-covered plan or agreement. #### 1. Caspio Caspio is probably one of the first platforms I'd evaluate. Its **HIPAA Edition includes a signed BAA**, dedicated HIPAA environment, encryption, audit trails, and unlimited users. Current pricing shown by Caspio starts at **$800/month with a one-year term**. [www.caspio.com](https://www.caspio.com/compliance/hipaa/?utm_source=chatgpt.com) [Caspio HIPAA Edition](https://www.caspio.com/hipaa-edition/) #### 2. Knack Health Knack now has a healthcare-specific product, **Knack Health**, with a signed BAA, encrypted storage/transmission, role-based permissions, and record-change logs. Its HIPAA plans are specifically designed for healthcare applications. [www.knack.com](https://www.knack.com/health/hipaa-database/?utm_source=chatgpt.com) [Knack Health](https://www.knack.com/health/) This is particularly interesting if you're building something like a **patient portal, care-management system, home-care application, intake system, or internal healthcare operations app**. #### 3. Zoho Creator Zoho Creator supports HIPAA workflows and allows customers to request its BAA. It has ePHI field designation, encryption, granular permissions, audit trails, and backups. [help.zoho.com](https://help.zoho.com/portal/en/kb/creator/security/hipaa/articles/zoho-creator-hipaa-compliance-guide?utm_source=chatgpt.com) [Zoho Creator HIPAA information](https://help.zoho.com/portal/en/kb/creator/security/hipaa/articles/zoho-creator-hipaa-compliance-guide) One caveat: **the BAA specifies which Zoho services are covered**, so don't assume every Zoho product/integration is automatically inside your HIPAA boundary. [www.zoho.com](https://www.zoho.com/hipaa.html?utm_source=chatgpt.com) #### 4. Microsoft Power Apps Microsoft Power Apps is another strong option if you're comfortable with the Microsoft ecosystem. Microsoft provides a HIPAA BAA covering its in-scope services, and Power Apps/Dataverse can be used to build custom applications. [learn.microsoft.com](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech?utm_source=chatgpt.com) [Microsoft HIPAA compliance documentation](https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech) The downside is that Power Apps is more enterprise-oriented and can become complicated from a licensing/architecture standpoint. #### 5. Quickbase Quickbase supports HIPAA with a BAA, but HIPAA access is generally associated with its higher-tier/business engagements rather than the entry-level offering. [www.caspio.com](https://www.caspio.com/blog/best-quickbase-alternative-for-no-code-apps-2026/?utm_source=chatgpt.com) ### Platforms I'd be careful about **Bubble:** I would **not** use Bubble for an application that directly handles PHI. Bubble's own documentation currently says that the platform does **not** meet HIPAA requirements and that it does not support HIPAA-compliant apps. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Glide:** It's a popular no-code platform, but I wouldn't put it in the same "confirmed BAA + healthcare-specific infrastructure" bucket without getting written confirmation from Glide for your exact plan and use case. **Webflow:** Fine for a marketing site around a healthcare product, but don't treat Webflow itself as your PHI datastore. You can, for example, embed a BAA-backed Formstack form into a Webflow site. [webflow.com](https://webflow.com/integrations/formstack?utm_source=chatgpt.com) ### If you're building an actual healthcare product I'd narrow the field to: **Caspio → Knack Health → Power Apps → Zoho Creator** And I'd choose based on what you're building: - **Patient-facing/custom database app:** Caspio or Knack - **Healthcare-specific internal application:** Knack Health - **Microsoft enterprise environment:** Power Apps + Dataverse - **Budget-conscious custom app:** Zoho Creator - **Forms/intake/e-signatures:** Formstack - **Complex enterprise operations:** Quickbase One crucial point: **the BAA is only one piece of HIPAA compliance.** Your integrations, email provider, analytics, file storage, authentication, AI services, and other subprocessors that touch PHI may each need appropriate HIPAA coverage/BAAs as well. Formstack, for example, explicitly warns that the customer remains responsible for compliance across the entire workflow and integrations. [help.formstack.com](https://help.formstack.com/hc/en-us/articles/44593118493843-Maintaining-HIPAA-Compliance-with-Formstack?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, SaaS healthcare app, intake form, CRM, scheduling system, home-care app), I can narrow this down to the **3 best platforms and compare their approximate costs, BAA requirements, database capabilities, APIs, and limitations**.

Yes. A **no-code front end can work with a HIPAA-compliant backend**, but the front end itself and the way data moves between the two matter. A typical architecture is: **No-code UI → secure API → HIPAA-compliant backend/database** Key requirements: - **BAA:** Any vendor that handles PHI on your behalf generally needs to sign a Business Associate Agreement (BAA). - **PHI exposure:** Make sure the no-code platform isn't storing PHI in its own database, logs, analytics, or error-tracking systems unless it supports HIPAA use and a BAA. - **Secure connections:** Use HTTPS/TLS and authenticated API calls between the front end and backend. - **Authentication & authorization:** Use strong authentication and enforce role-based access on the backend—not just in the no-code UI. - **Audit logging:** HIPAA requires appropriate controls for tracking access to ePHI. - **Backups, encryption, and access controls:** These need to be properly configured on the backend and supporting infrastructure. - **Third-party integrations:** Be especially careful with analytics, email, forms, chat, payment, and automation tools; they can accidentally receive PHI. One important distinction: **a HIPAA-compliant backend doesn't automatically make the entire application HIPAA compliant.** Compliance depends on the complete system, configuration, vendors, policies, and how you use it. If you tell me **which no-code front end and which backend** you're considering (e.g., Bubble + AWS, FlutterFlow + Supabase, Webflow + custom API), I can tell you whether that combination is realistically workable for HIPAA and what you'd need to configure.