Do Vercel, Netlify and Firebase Sign a HIPAA BAA? (2026)

Two of the three do, and the third only partly. As of October 2026, Vercel signs a BAA with Pro teams that buy a $350/month HIPAA add-on and with Enterprise customers; Netlify signs one with Enterprise customers only; and Firebase has no BAA of its own, so only the Firebase-adjacent products that appear on Google Cloud’s HIPAA covered-services list (such as Firestore and Cloud Storage) can hold PHI under Google Cloud’s BAA. In all three cases the BAA covers the host, not your database, email provider or analytics, and each of those needs its own agreement. The table below links each answer to the vendor’s own page.

1. The Comparison Table

Checked against each vendor’s own pages on 12 October 2026.

2. Vercel: Pro Add-On or Enterprise

Vercel’s compliance documentation (updated 8 September 2026) says Vercel supports HIPAA as a business associate and signs BAAs “with eligible Pro and Enterprise customers.” The pricing page lists the HIPAA BAA as “Not available” on Hobby, “$350 / month” on Pro, and “Custom” on Enterprise. Pro teams buy it from Billing settings; Enterprise teams ask their account team.

On scope, Vercel’s HIPAA guide says its BAA “covers our entire global infrastructure” and names the CDN, Vercel Functions, the build and deploy pipeline, environment variables and Static IPs. Read the agreement itself for the authoritative list; the guide is a summary. The same guide is clear that databases and other third-party providers that store PHI need their own BAAs.

Caveats worth knowing:

• Secure Compute is Enterprise-only. Private, isolated environments with dedicated outbound IPs and VPC peering are available on Enterprise plans. Vercel presents this as additional protection, not a BAA requirement, but if your database must only accept traffic from a private network, Pro won’t get you there.
• Marketplace integrations are separate vendors. A database or KV store you add through Vercel’s marketplace is a different company; check that it signs its own BAA.
• v0 is a different product. Building UI in v0 and deploying to Vercel are separate questions. Our v0 and Vercel HIPAA guide covers the builder side.
• Logs and observability. Function logs capture whatever your code prints. Keep PHI out of them, and check where any log drain sends data.

3. Netlify: Enterprise Only

Netlify announced a HIPAA-compliant service offering in August 2024, according to its 2024 product recap. Its announcement says “enterprise customers handling PHI can now execute a Business Associates Agreement (BAA) with Netlify,” and directs teams to sales and solution engineering. The public pricing page (Free, Personal $9, Pro $20, Enterprise custom) doesn’t mention HIPAA, so treat the Free, Personal and Pro plans as having no BAA path.

One documented exclusion matters if you use Netlify’s own database. Netlify’s Database documentation says: “Database Services are not HIPAA-eligible by default” and “You must not store Protected Health Information in Database Services that are not set up to be HIPAA compliant.” Customers have to contact Netlify to configure their account. Netlify doesn’t publish a product-by-product list of what its BAA covers, so ask about Functions, Edge Functions, Forms, Blobs and log drains for your account before launch. Netlify Forms in particular is a common place for a contact form to quietly collect symptoms or insurance details.

4. Firebase: Through Google Cloud, Product by Product

Firebase is the hardest of the three to answer, because “Firebase” is a bundle of products under two sets of terms.

• Firebase has no HIPAA BAA of its own. Firebase’s privacy page doesn’t mention HIPAA, and Firebase product terms such as the Crashlytics and App Distribution terms say Google “does not intend use of the Services to create obligations” under HIPAA and “makes no representations that the Services satisfy HIPAA requirements.”
• Google Cloud’s BAA covers only listed products. You accept it in the console (IAM & Admin > Privacy, “Review and Accept”). The covered-services list (page updated 9 October 2026) names the products, and Firebase products appear there only under their Google Cloud names.

Our reading: you can build a HIPAA app on Firestore, Cloud Storage and Cloud Run functions under Google Cloud’s BAA, but you have to treat the rest of the Firebase console as off-limits for PHI unless Google confirms otherwise in writing. Google’s own rule on the HIPAA page is blunt: “If you can’t disable a service, you must not use it for PHI.”

5. What a Hosting BAA Does and Doesn’t Cover

HIPAA requires a written BAA with every vendor that creates, receives, maintains or transmits PHI for you (45 CFR 164.504(e)). HHS’s cloud computing guidance adds that a provider storing only encrypted PHI is still a business associate. So a host that serves your app’s API or renders pages with patient data needs a BAA, even if the database is somewhere else.

The reverse also holds. A host’s BAA doesn’t extend to:

• Your database (Supabase, Neon, MongoDB Atlas, etc.). See our Supabase HIPAA guide for one example.
• Email, SMS and push providers.
• Analytics, session replay and error tracking scripts loaded in the browser.
• AI model APIs your functions call. Our HIPAA-compliant AI guide lists which providers sign.
• The app builder you used to generate the code, if it can see production data.

A purely static marketing site with no forms and no patient data generally doesn’t need a BAA at all. The question is whether PHI ever passes through the host.

Which one to pick

If you already deploy a Next.js app on Vercel Pro and your database vendor signs its own BAA, the $350/month add-on is the shortest path, because you don’t change platforms. If you need private networking between your functions and your database, budget for Vercel Enterprise and Secure Compute. If your organization already buys Netlify Enterprise, ask its account team to add the BAA and confirm the scope covers the features you use. If you want a backend and hosting under one large cloud agreement, Google Cloud’s BAA with Firestore, Cloud Storage and Cloud Run is workable, provided you keep PHI away from the Firebase products that aren’t on Google’s list. In every case, the deciding factor is usually the rest of the data path, not the host.

6. Checklist Before PHI Goes Live

1. Map every place PHI flows: browser, server functions, database, file storage, logs, third-party scripts.
2. For each vendor on that map, get a signed BAA or remove PHI from that path.
3. On Vercel, buy the add-on (Pro) or sign through sales (Enterprise) before deploying code that handles real data.
4. On Netlify, confirm Enterprise BAA scope in writing, including Database, Forms and Functions.
5. On Firebase, accept Google Cloud’s BAA and limit PHI to products on the covered list.
6. Strip PHI from server logs and error reports; review log drains.
7. Enforce MFA and least-privilege roles on the hosting account; previews and deployment logs are visible to everyone on the team.
8. Keep real data out of preview deployments.
9. Add application-level audit logging and encryption decisions to your risk analysis; the host doesn’t do those for you.

7. Where VertiComply Fits

VertiComply generates full-stack healthcare apps (web and native iOS/Android) with encryption, audit logging, role-based access control and session timeouts built in on every plan. It signs a BAA on request on all paid plans (Pro $89/month, Business $249/month, Enterprise $349/month), not on Free. Pro and above include code export, so you can deploy the generated code to Vercel, Netlify Enterprise or Google Cloud under that host’s BAA if you prefer. VertiComply does not hold a SOC 2 or HITRUST attestation. The BAA page has the details, and our list of platforms that sign a BAA compares the builders.

Frequently Asked Questions

Does Vercel sign a HIPAA BAA?

Yes. As of October 2026 Vercel signs a BAA with Pro teams that buy the HIPAA add-on, listed at $350 per month, and with Enterprise customers on custom terms. Hobby plans are not eligible. Vercel’s BAA covers Vercel’s platform; your database and other providers need their own BAAs.

Does Netlify sign a HIPAA BAA?

Yes, for Enterprise customers. Netlify announced its HIPAA offering in August 2024 and arranges the BAA through its sales team. Netlify’s Database Services are not HIPAA-eligible by default and must be configured with Netlify before they hold PHI.

Is Firebase HIPAA compliant?

Not as a whole. Firebase has no BAA of its own. Google Cloud’s BAA covers products on its HIPAA list, which includes Firestore, Cloud Storage, Cloud Run functions and Identity Platform, but not Firebase Hosting, Realtime Database, Crashlytics or Analytics by name. Keep PHI in covered products only.

Is Firebase Authentication HIPAA compliant?

Firebase Authentication is not named on Google Cloud’s HIPAA covered-services list; Identity Platform is. Google’s guidance for Identity Platform says not to store PHI in display names, photo URLs or custom attributes and not to use anonymous accounts for PHI. Confirm your setup with Google before relying on it.

Do I need a BAA with my host if my database is HIPAA compliant?

Usually yes. If server functions, API routes or server-rendered pages on the host process patient data, the host is handling PHI and needs a BAA. Only a host that never receives PHI, such as one serving static files while the browser talks directly to a covered backend, may not need one.

Last reviewed 12 October 2026. Plan names, prices and covered-service lists change; check each vendor’s pricing and compliance pages for the current position. Nothing here is legal advice on whether HIPAA applies to a specific product.