--- title: How to build and maintain HIPAA-compliant applications on Vercel description: Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. url: /kb/guide/hipaa-compliance-guide-vercel canonical_url: "https://vercel.com/kb/guide/hipaa-compliance-guide-vercel" published: 2025-11-03 last_updated: 2026-08-18 authors: Vercel related: - /docs/security/shared-responsibility - /docs/vercel-firewall - /docs/security/compliance - /docs/global-config - /docs/networking/static-ips - /docs/networking/secure-compute - /docs/rbac - /docs/audit-log - /docs/environment-variables - /blog/vercel-supports-hipaa-compliance install_vercel_plugin: npx plugins add vercel/vercel-plugin --- ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [Does Vercel support HIPAA compliance?](https://vercel.com/kb/guide/is-vercel-hipaa-compliant?from=related) — Learn about Vercel and HIPAA compliance. - [Overview](https://vercel.com/docs/security?from=related) — Vercel provides built-in and customizable features to ensure that your site is secure. - [Kubernetes](https://vercel.com/docs/integrations/external-platforms/kubernetes?from=related) — Deploy your frontend on Vercel alongside your existing Kubernetes infrastructure. - [Does Vercel have a SOC 2 Type 2 attestation?](https://vercel.com/kb/guide/is-vercel-soc-2-compliant?from=related) — Vercel holds a SOC 2 Type 2 attestation for Security, Confidentiality, and Availability. See what the report covers, how - [Ensuring safe and effective infrastructure testing](https://vercel.com/kb/guide/ensuring-safe-and-effective-infrastructure-testing?from=related) — We conduct regular penetration testing through certified third-party assessors to secure the Vercel platform. This guide - [Hosting your API on Vercel](https://vercel.com/kb/guide/hosting-backend-apis?from=related) — Learn how to build and scale performant APIs on Vercel. - [Vercel vs Fastly](https://vercel.com/kb/guide/vercel-vs-fastly?from=related) — A detailed guide to Vercel vs Fastly: full-stack application platform vs edge infrastructure layer, covering framework s Full cross-link map for this page: [/kb/guide/hipaa-compliance-guide-vercel.graph.md](/kb/guide/hipaa-compliance-guide-vercel.graph.md) If you're building healthcare software that creates, receives, maintains, or transmits Protected Health Information (PHI), HIPAA compliance isn't optional, and where you deploy that software matters. This guide explains how Vercel supports HIPAA compliance and walks you through configuring your application to meet your obligations. > _Important: HIPAA compliance is a shared responsibility between the customer and Vercel, and customers are ultimately responsible for ensuring their own compliance with all applicable laws and regulations._ > _This guide is for informational purposes only and does not constitute legal advice. Each customer is responsible for independently evaluating its own use of the services, in accordance with our_ [_Shared Responsibility Model_](https://vercel.com/docs/security/shared-responsibility)_. Consult your own legal advisors on how to configure your use of the Vercel platform to maintain compliance with the data privacy laws and security standards relevant to your business._ With that in place, here's how to take an application from deployed on Vercel to deployed on Vercel _and_ configured for HIPAA. ## What HIPAA requires before you deploy Before you configure anything, get clear on what HIPAA governs. The [Health Insurance Portability and Accountability Act](https://www.hhs.gov/hipaa/) (HIPAA) is one of the most significant sectoral privacy regulations in the United States. The Secretary for [Health and Human Services](https://www.hhs.gov/) (HHS) developed a set of required national standards that protect the confidentiality, integrity, and availability of health data. Two categories of organization, covered entities and business associates, must comply with these standards so that health data is transmitted without compromising its security. Knowing which category you fall into matters, because it decides who signs what and where Vercel fits. That's the next thing to establish. ## How Vercel supports HIPAA compliance Vercel supports HIPAA compliance as a business associate. In practice, we commit to three things: - We implement and maintain appropriate technical and organizational security measures designed to safeguard a customer's [Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/privacy/index.html) (PHI). - We notify customers of any data breaches without undue delay. - We sign Business Associate Agreements (BAAs) with customers. Vercel also conducts a HIPAA audit annually. For more information about this and our other compliance frameworks, see the [Vercel Trust Center](https://security.vercel.com/). Once the BAA relationship is in place, much of the HIPAA-relevant security is already handled by the platform. Here's what that covers. ## What Vercel's security architecture covers for HIPAA Vercel's security architecture provides several advantages for HIPAA compliance before you write a line of configuration. The three areas healthcare teams ask about most are global infrastructure, serverless architecture, and zero-configuration security. ### Global infrastructure with consistent security Vercel's HIPAA BAA covers our entire global infrastructure, and that coverage gives healthcare organizations several advantages. Multi-regional redundancy keeps your healthcare applications available during regional outages, supporting the business continuity requirements essential to patient care systems. Our CDN places your application closer to users, reducing latency for time-sensitive healthcare services. Security controls remain consistent across all regions, so you don't have to manage varying implementations from one region to the next. Because there are no geographic restrictions on compliant deployments, you can serve patients globally while maintaining HIPAA compliance. ### Serverless architecture benefits Vercel's serverless approach carries security advantages for healthcare applications. Serverless functions reduce the attack surface, limiting potential entry points for attackers targeting sensitive health information. Automatic scaling keeps your application responsive during usage spikes without manual intervention, which matters for healthcare systems that see sudden demand. Built-in security features operate without additional configuration, and ephemeral execution environments create a fresh environment for each execution, reducing the risk of persistent vulnerabilities. ### Zero-configuration security Vercel handles several security requirements automatically, so your developers can focus on building applications rather than configuring security. Automatic HTTPS with SSL/TLS encryption protects patient data in transit and meets HIPAA transmission-security requirements without additional setup. Built-in DDoS mitigation and a [Web Application Firewall](https://vercel.com/docs/vercel-firewall) safeguard healthcare applications from common attack vectors. Integrated bot management and threat detection identify and mitigate suspicious activity before it affects patient data or service availability, and secure-by-default configurations apply across all services. These advantages come standard. The next step is knowing which services fall under the BAA and how responsibility is divided. ## Which Vercel services fall under the HIPAA BAA Vercel provides a secure infrastructure for storing and processing PHI. Understanding the division of security and compliance duties between Vercel and customers is essential for effective HIPAA implementation. When implementing security features, consult your organization's legal, compliance, and IT security advisors to determine the configuration requirements that align with your HIPAA obligations and risk management strategy. For the full division of duties, see our [security and compliance measures](https://vercel.com/docs/security/compliance). ### Core platform services Our foundational services are designed with security in mind and fully covered under the BAA: - CDN for secure, global content delivery - Vercel Functions for secure serverless application logic - [Global Config](https://vercel.com/docs/global-config) for low-latency configuration and feature-flag data - Build and deploy pipeline with security controls throughout - Environment variable management for secure credential handling - [Static IPs](https://vercel.com/docs/networking/static-ips) for secure integration with healthcare backends These services form the baseline for a HIPAA-ready deployment, and each one is included in the BAA you sign with Vercel. ### Enterprise security features Healthcare organizations benefit from our enterprise-grade security capabilities: - Vercel Secure Compute: Isolated cloud networks with dedicated IP addresses that provide security boundaries for sensitive workloads. - Fine-grained RBAC and access control: Identity and access management that integrates with existing healthcare identity systems. - Audit logging: Activity tracking that supports compliance requirements and security investigations. Together, these controls give healthcare teams network isolation, access governance, and an audit trail that HIPAA risk assessments tend to scrutinize first. ### Development and integration tools Our secure development tools support the entire healthcare application lifecycle: - Vercel CLI and development tools for secure local development - Git integrations and version control for code integrity and auditability - Marketplace integrations with HIPAA-compliant providers for extended functionality - Third-party service integrations that connect to your existing healthcare technology stack Knowing what's covered is half the work. The other half is configuring it correctly for your application. ## How to configure Vercel for HIPAA compliance This is where the shared responsibility model becomes concrete. Set up the following platform controls and workflow practices. ### Security settings Start with the platform controls that map most directly to your HIPAA obligations: - Enable Secure Compute: Available on Enterprise plans, [Secure Compute](https://vercel.com/docs/networking/secure-compute) gives you control over which resources can access your information through private, isolated cloud environments and dedicated outgoing IP addresses. - Set up VPC peering and VPN support: Built on top of Secure Compute, these let you create fewer entry points into your networks by establishing secure tunnels within your AWS infrastructure. - Configure custom domains: Serve traffic over your own domains with valid SSL/TLS certificates. - Set up team management: Apply [role-based access controls](https://vercel.com/docs/rbac) so team members only reach what they need. - Enable audit logging: Turn on [audit logging](https://vercel.com/docs/audit-log) for compliance monitoring and reporting. - Configure environment variables: Store credentials in [environment variables](https://vercel.com/docs/environment-variables) rather than in code. Configure these once, and they apply to every deployment in the project, which keeps your security posture consistent as the application grows. ### Development best practices Keep your delivery workflow as disciplined as the platform configuration. Implement proper separation between development, staging, and production environments using custom environments, so PHI never reaches a preview or test context that isn't covered by your controls. With the platform configuration locked down, turn to where your PHI actually lives. ## How to secure your databases and storage for HIPAA Most PHI ends up in a database or storage layer, and much of that sits outside Vercel. Treat those integrations with the same rigor you apply to the platform itself. ### External database integration Apply the same scrutiny to every provider that touches PHI on your behalf: - Confirm your database providers offer HIPAA-compliant services. - Execute BAAs with those providers. - Verify encryption at rest and in transit. - Implement proper backup and disaster recovery procedures. - Use Static IPs or Secure Compute to securely reach backend providers. Each provider that stores or processes PHI is a business associate in its own right, so the BAA chain has to extend all the way down your stack. ### Data residency and backup Know where your data lives and how you would recover it: - Understand your data storage locations and their cross-border implications. - Implement appropriate backup retention policies. - Confirm disaster recovery procedures meet your business continuity requirements. - Document data handling procedures for audit purposes. Documenting these decisions now gives you the paper trail an auditor or breach investigation will ask for later. Once your data is secured, compliance becomes a matter of maintaining that security. ## How to maintain HIPAA compliance over time HIPAA compliance isn't a one-time setup. The teams that stay compliant treat it as an ongoing practice rather than a launch checklist, built around regular monitoring and current records. ### Ongoing monitoring Build these reviews into a recurring cadence rather than a one-time pass: - Review access logs and audit trails regularly. - Monitor security alerts and incidents continuously. - Review team member access and permissions periodically. - Assess third-party integrations and dependencies regularly. Catching access drift and dependency changes early is what keeps a compliant launch from quietly becoming a noncompliant production system. ### Compliance auditing Keep your evidence current so you can demonstrate compliance on demand: - Document all security configurations and procedures. - Maintain records of risk assessments and mitigation strategies. - Prepare for compliance audits and assessments. - Review and update security policies regularly. Well-maintained records turn an audit from a scramble into a routine review. ## Next steps Vercel gives healthcare teams a HIPAA-ready foundation. Our BAA covers the entire global infrastructure; services are secure by default; and enterprise controls like Secure Compute, fine-grained RBAC, and audit logging provide the network isolation and access governance that HIPAA assessments look for. Your side of the shared responsibility model is to configure those controls, vet your database and storage providers, and maintain monitoring over time. To put that foundation in place from your first deploy, [start a Vercel project](https://vercel.com/new). To begin from a working example instead, [browse the templates](https://vercel.com/templates). ## Related resources - [Shared Responsibility Model](https://vercel.com/docs/security/shared-responsibility) - [Security and compliance measures](https://vercel.com/docs/security/compliance) - [Vercel Secure Compute](https://vercel.com/docs/networking/secure-compute) - [Vercel supports HIPAA compliance](https://vercel.com/blog/vercel-supports-hipaa-compliance) - [Vercel Trust Center](https://security.vercel.com/) ## Frequently asked questions ### How can my organization sign a BAA with Vercel? The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA. Pro customers purchase the HIPAA add-on under Settings \\> Billing in the dashboard to obtain a BAA. Enterprise customers should contact their Customer Success Manager or Account Executive. ### Does having a BAA with Vercel guarantee HIPAA compliance? No. A BAA helps support your HIPAA compliance, but using Vercel doesn't automatically make your organization compliant. You remain responsible for your own compliance programs and internal processes, and for ensuring that your specific use of Vercel aligns with HIPAA requirements throughout your application. ### My healthcare SaaS runs on Vercel. Do my customers need their own BAA? No. If you're a SaaS provider with a healthcare solution on Vercel, your customers can sign a BAA directly with you. Your own BAA with Vercel already covers the infrastructure your product runs on. They don't need a separate BAA with Vercel, unless they also use Vercel services independently of your product. ### Is Vercel a conduit or a business associate under HIPAA? Generally, Vercel is a business associate. Our services typically involve creating, receiving, maintaining, or transmitting PHI, which qualifies Vercel as a business associate. The conduit exception is limited and applies only to pure transmission services with temporary storage incident to that transmission. ### Can I store PHI internationally and stay HIPAA compliant? Yes. HIPAA permits international data storage with proper BAAs and safeguards in place. You must conduct a risk assessment that considers geographic and geopolitical risks, then implement additional safeguards as needed to protect PHI stored or processed outside your primary region.