Is Vercel HIPAA Compliant? What the BAA Covers (2026)

Vercel will sign a HIPAA Business Associate Agreement. Just not on every plan: the pricing page lists the BAA as not available on Hobby, a $350/month add-on on Pro, and custom on Enterprise. If you prototyped a health app on a free account, that's the first fact that matters.

The second fact matters more. A BAA with Vercel covers Vercel, and that's all it covers. The database holding your patient records, the analytics script on every page, and the AI API reading intake forms are each a separate company that needs its own agreement.

Vercel's answer, in its own words

Vercel's compliance docs say it supports HIPAA by:

• maintaining technical and organizational safeguards for customers' protected health information (PHI),
• notifying customers of breaches "without undue delay",
• "signing Business Associate Agreements (BAAs) with eligible Pro and Enterprise customers."

Its HIPAA guide is just as direct about the limit. Asked whether a BAA with Vercel guarantees HIPAA compliance, the answer is: "No. A BAA helps support your HIPAA compliance, but using Vercel doesn't automatically make your organization compliant."

So "is Vercel HIPAA compliant" is the wrong question. Vercel can be your HIPAA-compliant host. Whether your app is compliant depends on everything you put on it.

What you get on each plan

Source: vercel.com/pricing and Vercel's security and compliance docs, read on 2026-10-20. When Vercel announced HIPAA support in May 2024 it was for Enterprise customers only; the Pro add-on came later.

Secure Compute isn't required for HIPAA. Vercel's docs describe it as "additional layers of protection" for customers subject to HIPAA. A Pro team with the add-on can sign a BAA without it.

What the BAA covers

Vercel's HIPAA guide lists the core platform services as "fully covered under the BAA":

• the CDN,
• Vercel Functions,
• Global Config,
• the build and deploy pipeline,
• environment variable management,
• Static IPs.

It also says the BAA covers Vercel's "entire global infrastructure", so there's no region you have to pin to.

What it doesn't cover

This is where vibe-coded health apps fall apart. The typical stack Cursor or Lovable generates looks like this:

Vercel's guide puts it plainly: "Each provider that stores or processes PHI is a business associate in its own right, so the BAA chain has to extend all the way down your stack." Any row with "No" that touches PHI needs a BAA with that vendor, or it needs to stop touching PHI.

Supabase is a good example of how much a database BAA asks of you. Its docs say an organization "must have a signed BAA with Supabase and have the HIPAA add-on enabled when dealing with PHI." Then each project gets set to High Compliance, which requires Point in Time Recovery (so at least a small compute add-on), SSL enforcement, network restrictions and Postgres connection logging. Supabase also notes that self-hosted Supabase doesn't come with these controls.

Two gaps that are entirely on you

Preview deployments with real data

Vercel's guide says to separate development, staging and production "so PHI never reaches a preview or test context that isn't covered by your controls." In practice, the way this goes wrong is an environment variable. If your Preview environment has the same DATABASE_URL as Production, every pull request deploys a URL that reads real patient records.

Check it in ten seconds:

vercel env ls preview
vercel env ls production
# Any database URL, Supabase key or API key that appears in both
# means preview builds can read production data.

Point Preview at a separate database seeded with fake records. Turning on Deployment Protection is good too, but it controls who can open the preview, not what the preview can read.

PHI in your own logs

Function logs show up in the Vercel dashboard and in any log drain you've set up. AI-generated route handlers love to log the whole request body while debugging, and those lines tend to survive into production:

// app/api/intake/route.ts
export async function POST(req: Request) {
  const body = await req.json();
  console.log("intake received", body); // name, DOB, symptoms -> your logs
  // ...
}

grep -rnE "console\.(log|info|error)\(.*(body|req|request|patient|form)" \
  app/ pages/ src/ lib/ 2>/dev/null

Log an ID and an outcome, not the payload. If you've set up a log drain to a third party (Datadog, Axiom, Better Stack), that destination is another vendor in the BAA chain.

A HIPAA checklist for a Vercel app