vitalsphere.digital

The short answer is: **not by default, and you should verify carefully before using it for PHI.** Softr markets features for healthcare applications (such as patient portals) and states that it provides security features like encryption, role-based permissions, and SOC 2 Type II compliance. However, **SOC 2 compliance is not the same as HIPAA compliance**. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com) If you need to build an application that stores or processes **protected health information (PHI)**, you should confirm all of the following before using Softr: - **Business Associate Agreement (BAA):** A HIPAA-compliant cloud service handling PHI must be willing to sign a BAA with you. This is a core HIPAA requirement. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) - **HIPAA-specific safeguards:** Encryption, access controls, audit logging, breach notification procedures, and administrative controls must all be in place—not just secure infrastructure. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) - **Your data source:** If you're connecting Softr to Airtable, Google Sheets, SQL, or another backend, **every service that stores or transmits PHI must also be HIPAA-eligible and covered by a BAA**. A compliant frontend does not make a non-compliant backend compliant. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) One nuance is that Softr's healthcare marketing pages now refer to "HIPAA-conscious" permissions and even mention "HIPAA-compliant authentication" for certain healthcare templates. These are marketing claims rather than a blanket statement that **the entire platform is HIPAA compliant for all customers and plans**. [www.softr.io](https://www.softr.io/blog/soc2-certification?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com)[www.softr.io](https://www.softr.io/create/patient-portal?utm_source=chatgpt.com) **My recommendation:** If you're planning to handle real patient data, ask Softr these questions before proceeding: 1. Will you sign a **Business Associate Agreement (BAA)**? 2. Which plans include HIPAA support? 3. Which components of the platform are covered by the BAA? 4. What subprocessors are involved, and are they also HIPAA-compliant? 5. What audit logging, access controls, and retention features are available? If Softr **will not sign a BAA** for your intended use, you should assume it is **not suitable for storing or processing PHI**, regardless of its SOC 2 certification. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me your use case (e.g., patient portal, intake forms, scheduling, internal admin app, etc.), I can help determine whether Softr is an appropriate choice or suggest HIPAA-ready alternatives.

**Not currently, at least not as a HIPAA-compliant platform you can rely on for PHI.** As of **August 2026**, Bubble says it is **SOC 2 Type II compliant** and provides security features such as encryption, access controls, and privacy rules, but that is different from HIPAA compliance. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) More importantly, Bubble's own January 2026 update says **HIPAA compliance is still in development** and is intended to be an **Enterprise feature**. [bubble.io](https://bubble.io/blog/january-2026-founder-ama/?utm_source=chatgpt.com) ### What this means If your Bubble app will handle **PHI (protected health information)** and you're subject to HIPAA: - **Don't put PHI directly into Bubble's database/files yet** unless Bubble has specifically executed a **BAA** with you and confirmed the relevant HIPAA-compliant configuration. - Using AWS underneath Bubble doesn't automatically make the Bubble application HIPAA compliant. Bubble itself has noted that HIPAA requires the relevant components and processes—not merely HIPAA-capable infrastructure—to comply. [forum.bubble.io](https://forum.bubble.io/t/josh-request-for-a-security-q-a-guide/42942?utm_source=chatgpt.com) - You can potentially use Bubble as a **non-PHI frontend** while keeping PHI in a separate HIPAA-compliant system, but the architecture needs to be designed carefully so PHI isn't inadvertently transmitted to Bubble through workflows, logs, analytics, plugins, error reporting, etc. - Bubble's current terms also contain language stating that its services are **not tailored to comply with industry-specific regulations such as HIPAA**. [e0845b89cf6f83c04d7338cfe5f77a8b.cdn.bubble.io](https://e0845b89cf6f83c04d7338cfe5f77a8b.cdn.bubble.io/f1697752102237x838918827908980500/Terms%20%26%20Condition%20.pdf?utm_source=chatgpt.com) If you're considering Bubble for a **healthcare app**, I can also lay out **3 viable architectures (Bubble + HIPAA backend, fully HIPAA-compliant no-code alternatives, or moving off Bubble)** and tell you which I'd choose for your use case.

As of **August 2026, Bubble is not yet HIPAA compliant** in the sense you would need for an application handling PHI. Bubble itself says HIPAA compliance is something it is **actively working toward**, and in January 2026 said it expected HIPAA to become an **Enterprise feature**. [bubble.io](https://bubble.io/blog/january-2026-founder-ama/?utm_source=chatgpt.com) Bubble does have substantial security controls—SOC 2 Type II, encryption, access controls, AWS hosting, etc.—but those **do not by themselves make Bubble HIPAA compliant**. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) ### What this means in practice If your Bubble app will handle **PHI** (patient names tied to medical information, diagnoses, treatment information, medical records, etc.): - **Don't assume Bubble is HIPAA compliant just because you use AWS.** - A HIPAA-compliant architecture generally requires the relevant vendors to be willing to execute **Business Associate Agreements (BAAs)** and satisfy HIPAA's administrative, physical, and technical requirements. - Keeping PHI exclusively in a separate HIPAA-capable backend does **not automatically make the overall Bubble application compliant** if PHI passes through or is stored in Bubble. - Bubble's own acceptable-use policy puts responsibility on customers to implement appropriate security measures for user data. [bubble.io](https://bubble.io/acceptable-use-policy?utm_source=chatgpt.com) So if you're considering Bubble for a **healthcare/SaaS product**, I'd currently treat the answer as **“no, not for an application that requires HIPAA compliance.”** If you tell me **what you're building with Bubble and where the PHI would be stored**, I can map out whether you could safely use Bubble as the frontend and what architecture/vendors would be needed.

**As of August 2026, Bubble is not currently HIPAA compliant.** Bubble does have substantial security controls—SOC 2 Type II, encryption at rest/in transit, privacy rules, 2FA, security scanning, etc.—but **those do not make Bubble HIPAA compliant**. [bubble.io](https://bubble.io/security?utm_source=chatgpt.com) More importantly, Bubble itself said in its January 2026 founder AMA that **HIPAA compliance is still being worked on** and is expected to be an **Enterprise feature**. [bubble.io](https://bubble.io/blog/january-2026-founder-ama/?utm_source=chatgpt.com) ### What this means for a healthcare app If your Bubble app will **store, process, or transmit PHI** (protected health information), I would **not put PHI directly into Bubble's database or rely on Bubble as your HIPAA-covered infrastructure today**. You can potentially use Bubble as the **UI/application layer** while keeping PHI in a separate HIPAA-compliant backend/service, but the architecture needs to be designed carefully so PHI doesn't leak into Bubble through things like: - Bubble database fields - server logs/error logs - analytics - email/SMS integrations - file uploads - plugins - API requests - third-party services Also, HIPAA compliance isn't simply a property of a platform. Your organization needs appropriate policies, safeguards, access controls, risk assessments, BAAs with applicable vendors, etc. If you tell me **what you're building with Bubble** (e.g., patient portal, telehealth app, medical scheduling, AI medical app, practice management), I can suggest a **HIPAA-safe Bubble architecture** and identify what should/shouldn't live in Bubble.