No. Bubble's own documentation states that apps built on Bubble do not achieve HIPAA compliance, and Bubble offers no Business Associate Agreement on any plan as of August 2026. In July 2026 Bubble said it is working on HIPAA support, targeting a separate Enterprise plan by the end of 2026. Until that ships, there is no signed agreement covering patient data held in Bubble.
| Fact | Value |
|---|---|
| Tool | Bubble |
| Verdict | No |
| Sources checked | August 2026 |
| Typical range | $13,000–$25,000 |
| Typical timeline | 6–10 weeks |
| Last updated | August 2026 |
What Bubble publishes, and what it does not
This table lists documents and programs Bubble makes available. "Covered" means Bubble publishes it. It does not mean the document has HIPAA meaning — only a signed Business Associate Agreement does.
Your PHI
Your Bubble app
Inside the agreement — PHI may live here
- SOC 2 report and SOC 3 report
- GDPR / Data Processing Addendum
Outside it — PHI here is a gap
- Business Associate Agreement (BAA)
- HIPAA support (today)
- HIPAA support (announced)
- HIPAA on the Enterprise plan
| Service | Under the BAA | Condition |
|---|---|---|
| Business Associate Agreement (BAA) | Not covered | Not offered on any plan. Bubble never writes the sentence "we do not sign BAAs" — this is an absence, not a statement: no BAA appears in Bubble's docs, pricing pages or Trust Center resources as of August 2026. |
| HIPAA support (today) | Not covered | Bubble's documentation states the platform and its internal processes currently do not meet HIPAA standards, and that apps built on Bubble won't achieve HIPAA compliance. |
| HIPAA support (announced) | Unconfirmed | In July 2026 Bubble wrote "But we're working on it." — with a separate Enterprise plan targeted for the end of 2026. A target, not a delivery date. Nothing to sign today. |
| HIPAA on the Enterprise plan | Not covered | Bubble's pricing page lists custom workload units, choice of hosting location and customization for Enterprise. HIPAA is not among them (checked August 2026). |
| SOC 2 report and SOC 3 report | Covered | Both listed in Bubble's Trust Center. SOC 2 is an audit of stated controls. It is not a BAA and does not substitute for one. |
| GDPR / Data Processing Addendum | Covered | A DPA and a subprocessor list are published. A DPA governs personal data under EU law; it is a different instrument from a BAA and does not cover PHI under HIPAA. |
Bubble maintains these pages and moves them — the HIPAA doc URL changed before we published this. Everything here was read on the vendor's own pages in August 2026. Check the links yourself before you act on any of it.
Why some blogs say Bubble does offer a BAA
What secondary sources say
Several third-party Bubble blogs state that Bubble provides HIPAA support and will sign a Business Associate Agreement on dedicated or enterprise plans.
- drapcode.com
- bubbleiodeveloper.com
What the vendor's own documentation says
Bubble's own documentation and its own blog say the opposite about today: the platform and its internal processes currently do not meet HIPAA standards, and apps built on Bubble won't achieve HIPAA compliance — on any plan. Bubble's pricing page describes Enterprise as custom workload units, choice of hosting location and customization. HIPAA is not in that list, and no BAA appears anywhere on Bubble's own pages.
How we resolve it
We go with the primary source: today, the answer is no. But those blogs were not making it up — they were early rather than wrong in direction. In July 2026 Bubble itself said it is working on HIPAA support, with a separate Enterprise plan targeted for the end of 2026. Read those posts as a forecast that has not landed yet. If you are planning around it, plan around the shipped product, not the target.
Where patient data actually escapes a Bubble app
The Bubble database and privacy rules
HighBubble sends data down to the browser and relies on privacy rules to decide which fields travel with it. A data type with no privacy rule is served in full — including fields your interface never shows on screen. A record does not have to be displayed to have left your server.
How to check
In the editor open Data → Privacy and select the data type holding patient records. If it has no rule, or if the "Everyone else" role still has fields ticked, those fields are reaching the browser of anyone who can load the page.
Uploaded files: photos, PDFs, lab results, insurance cards
HighA file uploaded through Bubble gets its own URL on Bubble's file storage. Unless that file is attached to a thing and inherits that thing's privacy rules, the URL works on its own — no login, no session, no expiry. Forwarded links keep working.
How to check
Upload one test file to your own app, copy its URL out of the Data tab, then paste it into a private browser window where you are logged out. If it opens for you, it opens for anyone who ever received that link.
API Connector calls and installed plugins
HighEvery API Connector call, AI plugin, SMS plugin, scheduling plugin and analytics plugin receives whatever fields you pass into it. Each of those companies becomes another place patient data sits, and Bubble's published subprocessor list says nothing about the vendors you added yourself.
How to check
Open Plugins → API Connector and read the parameters of each call. Then search your workflows for those API actions and look at which dynamic fields are passed in. Anything that resolves to a name, a date of birth or a condition is your answer.
Server logs and the step-by-step debugger
MediumWorkflow runs are recorded in your app's logs, including values handed to backend and scheduled workflows. Anyone with editor access to the app can read them. The preview debugger goes further: in step-by-step mode it prints live field values on screen — frequently during a screen share.
How to check
In the editor open the Logs tab, choose server logs, and read a recent run of a workflow that touches a patient record. Then run the app in preview with the debugger in step-by-step mode and watch what the inspector shows.
The built-in Send email action
MediumMail sent by Bubble's built-in Send email action leaves through infrastructure you did not contract with and are not a party to. A reminder that names a clinic, a department or a medication carries the diagnosis with it, even when the body looks harmless. Bubble publishes a subprocessor list — read it to see who handles that mail before you assume.
How to check
Search your workflows for the Send email action and read each subject line and body as a stranger would. "Your dermatology appointment is tomorrow" already discloses a condition to whoever opens that inbox.
The development version's database
MediumA Bubble app has a development version and a live version with separate databases, and the live database can be copied into development. Once that happens, real records sit in the version that is least locked down and most widely shared with contractors.
How to check
Switch the editor to the development version, open Data → App data, and scan for real names and real dates of birth. If they are there, real patient data is in the development database — whoever put it there, and whenever.
Six questions before you contact anyone
Each one is answerable from the Bubble editor in under a minute. Answer honestly — the point is to find out whether you need help at all, and some readers will find they do not.
01Open Data → App data. Is there at least one field storing a name, date of birth, diagnosis, medication, appointment reason or insurance number belonging to a real person?
02In Data → Privacy, does every data type holding those fields have at least one privacy rule, with the "Everyone else" role's fields unticked?
03Do users upload files that contain patient information — photos, scans, lab PDFs, insurance cards?
04Open Plugins. Is there at least one installed plugin or API Connector call that touches patient data — an AI model, an email or SMS service, a scheduler, an analytics tool?
05Switch the editor to the development version and open Data → App data. Do you see real names or real dates of birth?
06Does anyone outside your company — a freelancer, an agency, a former contractor — still have editor access to the app?
What we do about it
Typical range
$13,000–$25,000
Typical timeline
6–10 weeks
- 01
Inventory
3–5 daysA written map of every Bubble data type, field, uploaded file, workflow and third-party call that currently holds or transmits patient data, with each leak surface on this page marked pass or fail and the evidence attached.
- 02
Target architecture and vendor list
1 weekAn architecture document showing what stays in Bubble and what moves out, plus the named list of vendors you will need a signed BAA with and the current vendors that drop out of the picture entirely.
- 03
Backend build and migration
2.5–4 weeksA running backend under a signed BAA holding the patient data, with per-user access controls and audit logging, and your existing records migrated out of the Bubble database with a reconciliation count you can check yourself.
- 04
Rewiring the Bubble app
1.5–3 weeksYour Bubble app reading and writing patient data through the new backend instead of its own database: privacy rules tightened, file uploads repointed, API Connector calls rewritten, development database cleared of real records.
- 05
Handover
3–5 daysA document stating where patient data now lives, which vendors are under BAA, what changed, and what your team has to keep doing — access reviews, log retention, offboarding — written so a non-technical founder can hand it to counsel.
What moves the number
- How many data types and fields hold patient data, and how many records have to migrate.
- Whether users upload files, and how many are already sitting in Bubble storage with live URLs.
- How many third-party calls and plugins touch patient fields and need replacing rather than repointing.
- Whether authentication stays on Bubble's user object or has to move with the data.
- Whether audit logging and access review exist at all today, or are being built from nothing.
- Whether the app is already live with real patients, which limits how much can change at once.
When not to hire us
- You have no real patient data yet. A prototype on synthetic data needs none of this. Build the product and come back before the first real record goes in — not after.
- You can wait. Bubble says it is working on HIPAA support with an Enterprise plan targeted for the end of 2026. If your launch is after that and you can carry the risk of a target slipping, waiting may cost you less than re-architecting now.
- Your findings are small — privacy rules to tighten, stale collaborators to remove, a development database to clear. Those are afternoon jobs. Our free Bubble guides cover them and we would rather you did them yourself.
- Your budget is under $13K. We will say so on the first call rather than scope down to something that leaves patient data sitting in the Bubble database.
Worth knowing either way
There is no government HIPAA certification
No authority certifies software as HIPAA-compliant. What exists is a signed Business Associate Agreement with every vendor that touches protected health information, plus the administrative, physical and technical safeguards you implement and document yourself.
SOC 2 is not a substitute for a BAA
Supabase states it plainly in its own documentation: “SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).” The same holds for every vendor here.
An absence of documentation is not a vendor promise
Several answers here rest on what vendor documents do not say. We name which documents we read and when. A vendor that has never published a HIPAA position may still decline to sign, and one that publishes nothing today may publish something next quarter.
The same question, for the other fifteen tools
Firebase
NoOnly the Google Cloud equivalents are covered — no Firebase-branded service is
Supabase
Yes, with conditionsBAA plus a paid HIPAA add-on, on the Team plan or above
v0 by Vercel
PartiallyVercel hosting is covered; v0 itself is contractually off-limits for PHI
Lovable
NoIts terms prohibit uploading protected health information
Bubble
NoIts own documentation says apps built on Bubble won't achieve compliance
Replit
NoIts Terms, Commercial Agreement and DPA carry no HIPAA or BAA terms
Bolt.new
NoNo BAA in the StackBlitz and Bolt documents we read; HIPAA is named only for self-hosted
FlutterFlow
NoIts terms bar processing HIPAA-protected data outright
Claude Code
Yes, with conditionsCovered only with zero data retention, on accounts Anthropic qualifies
Codex
Yes, with conditionsCodex Local on a Regulated or Healthcare tier; Codex Cloud is excluded
Cursor
Yes, with conditionsEnterprise only, with Privacy Mode locked organisation-wide
GitHub Copilot
NoNo BAA offered; the Data Protection Agreement tells customers not to send PHI
Devin
NoPHI is Prohibited Data under the acceptable-use policy
Hermes Agent
Not the right questionSelf-hosted — the agreement you need is with your model provider
OpenClaw
Not the right questionSelf-hosted — but the vendor-run router still receives prompts
Base44
NoNo BAA; its terms ask customers to keep PHI off the platform
Sources: two verbatim quotes and one observation
The first two entries below are quoted word for word from the vendor's own pages, read in August 2026. The third is not a quotation and is not presented as one — Bubble's Trust Center gives us a list of section labels rather than a sentence, so we restate what is printed there in our own words. That no Business Associate Agreement appears among those labels is our reading of the list, not a statement Bubble makes. Bubble nowhere writes that it does not sign BAAs; the absence is the evidence.
Bubble's own documentation states that apps built on the platform do not achieve HIPAA compliance.
HIPAA mandates that all aspects of a service need to be compliant for the overall product to fulfill its requirements. While some sub-processors might be HIPAA compliant, the entire Bubble platform and its internal company processes currently do not meet these standards. Consequently, apps built on Bubble won't achieve HIPAA compliance.
Bubble repeats the same answer on its own blog, and states that it is working on HIPAA support.
Bubble doesn't currently meet HIPAA standards, so apps built on Bubble won't achieve HIPAA compliance today, regardless of our other security features. But we're working on it.
Bubble Blog — How to Build a HIPAA-Compliant App in 2026Source dated: July 29, 2026Checked: August 2026Observation, not a quotation: Bubble's Trust Center lists SOC 2 and GDPR under Compliance and publishes seven documents under Resources. No Business Associate Agreement appears among them.
Frequently asked questions
Can I just ask Bubble for a BAA?
You can ask, but as of August 2026 there is nothing to sign. Bubble does not offer a Business Associate Agreement on any plan, and its own documentation says apps built on Bubble won't achieve HIPAA compliance. Bubble never states "we don't sign BAAs" — the agreement simply does not appear in its docs, its pricing pages or its Trust Center.
I read that Bubble is HIPAA compliant on Enterprise. Who's right?
Bubble is. Its documentation and its own July 2026 blog post both say the platform does not meet HIPAA standards today. The Enterprise plan on Bubble's pricing page offers custom workload units, choice of hosting location and customization — HIPAA is not among them. The blogs saying otherwise were early rather than invented: Bubble has said it is working on HIPAA support, targeting Enterprise by the end of 2026.
Bubble has SOC 2. Isn't that good enough?
They are different instruments. SOC 2 is an independent audit of the controls a company says it operates. A BAA is a contract in which a vendor accepts obligations for handling protected health information. A company can hold SOC 2 and still have no BAA to offer, which is exactly Bubble's position today. One does not substitute for the other.
Should I just wait for Bubble's HIPAA plan at the end of 2026?
That is a real option, and we say so in our "when not to hire us" section. Bubble has said it is working on it and named end of 2026 for an Enterprise plan. It is a target, not a commitment, and we cannot tell you what will ship or what it will cost. If your launch is before that date, or real patient records are already in the database, waiting is not the same as doing nothing — the data sits in Bubble the whole time.
Do I have to throw away my Bubble app and rebuild it?
No, and that is usually the wrong move. What we do is move the patient data out: Bubble keeps the interface, the workflows and the non-patient logic, and patient records move to a backend covered by a signed BAA that Bubble talks to. Founders brace for "rebuild it" and mostly do not need to hear it. The work typically runs 6–10 weeks.
We already launched and there are real patients in the database. What do we do first?
Two tracks at once. Talk to a healthcare attorney about what your obligations are — that question is theirs, not ours. On the technical side, stop new patient data flowing into surfaces you have not checked, then run the inventory: which fields, which files, which third-party calls, and whether the development database holds a copy. You cannot fix what you have not listed.
Does choosing a hosting location or a dedicated instance solve it?
No. Where the servers physically sit is a separate question from whether a vendor has agreed in writing to handle protected health information. Bubble lists choice of hosting location under Enterprise, and separately states that the platform does not meet HIPAA standards. The second statement is not undone by the first.
This page is technical information rather than legal advice: HIPAA compliance is a property of your whole system and the processes around it, not of any single tool, and vendor terms change — verify the current terms on Bubble's own pages and consult a healthcare compliance attorney before relying on anything here.
