The answer splits in two. Vercel signs a HIPAA BAA covering its hosting infrastructure, listed in its Pro plan documentation as a paid add-on at $350 per month, but Vercel's API Terms separately say you agree not to process protected health information through the v0 API or AI Solution. Hosting a PHI app on Vercel is one question; generating it in v0 on real patient data is answered no.
| Fact | Value |
|---|---|
| Tool | v0 |
| Verdict | Partially |
| Sources checked | August 2026 |
| Typical range | $13,000–$25,000 |
| Typical timeline | 6–10 weeks |
| Last updated | August 2026 |
What the BAA covers, and what it does not
"Covered" here means: named in Vercel's own documentation as falling under a Business Associate Agreement that you sign with Vercel. It says nothing about the safeguards on your side, and nothing about services Vercel's terms exclude.
Your PHI
Your v0 app
Inside the agreement — PHI may live here
- Vercel hosting infrastructure (your deployed application)
- HIPAA BAA on the Pro plan
- Vercel Secure Compute· conditional
- Your v0 inputs and outputs being used for model training· conditional
Outside it — PHI here is a gap
- Putting PHI through the v0 AI Solution or v0 API
- An Enterprise agreement lifting the v0 PHI restriction
| Service | Under the BAA | Condition |
|---|---|---|
| Vercel hosting infrastructure (your deployed application) | Covered | Vercel's HIPAA compliance guide states the BAA covers its entire global infrastructure. Last updated 2026-08-18. |
| HIPAA BAA on the Pro plan | Covered | Listed in Vercel's Pro plan documentation as a paid add-on at $350/month. Last updated 2026-07-15. |
| Putting PHI through the v0 AI Solution or v0 API | Not covered | Vercel's API Terms say you agree not to create, receive, maintain, transmit or otherwise process PHI through the v0 API or AI Solution. That is a restriction on what you may do, stated separately from — and regardless of — what the BAA reaches. |
| Vercel Secure Compute | Conditional | Vercel's compliance docs describe it as available on Enterprise plans. It is not part of the $350/month Pro add-on. |
| Your v0 inputs and outputs being used for model training | Conditional | v0's Privacy Policy ties this to your plan and to whether you opted in or out of Model Training. Check the setting on your own account. |
| An Enterprise agreement lifting the v0 PHI restriction | Unconfirmed | We read the v0 Enterprise Addendum (Last Updated: August 20, 2025) in full. The terms "Protected Health Information", "PHI", "HIPAA" and "160.103" do not appear in it. We found nothing that removes the API Terms restriction; if your contract has bespoke terms, ask Vercel in writing. |
Vercel has moved this before — the BAA used to be an Enterprise conversation and is now a priced Pro add-on — and Vercel's own pages have not fully caught up with each other. Re-check the Pro plan page and the charges on your account before relying on this table.
Vercel's own documentation disagrees with itself
What secondary sources say
Third-party write-ups on this question tend to say two things: that a Vercel BAA is an Enterprise-only arrangement you have to negotiate, and that the open question is whether that BAA extends to the v0 layer. The first is out of date, and the second misses the actual answer.
What the vendor's own documentation says
Vercel's Pro plan documentation (last updated 2026-07-15) lists the HIPAA BAA as a paid add-on at $350/month, which is not an Enterprise-only arrangement. Vercel's own Security & Compliance page (last updated 2026-07-08) still tells you to contact Vercel to request a BAA, names no price and no self-serve path, and states that Vercel signs BAAs with eligible Pro and Enterprise customers. Separately, the API Terms settle the v0 question outright: PHI is not to be processed through the v0 API or AI Solution at all.
How we resolve it
Read them by date. The Pro plan page is the newer of the two and names a priced add-on that exists today, so the $350/month route is real; the compliance page has not caught up, which is why so many third-party articles still say Enterprise-only. And the coverage debate is beside the point: whether or not a BAA reaches the v0 layer, a separate clause in the API Terms tells you not to put PHI through it. If Vercel's pages change after August 2026, the dates above are how you check us.
Where PHI actually leaks in a v0-built app
The v0 chat prompt, and anything attached to it
HighThis is the surface the API Terms name directly. A pasted patient row, a data export, a screenshot of a live dashboard, or a bug report with a real chart in it all travel through the v0 AI Solution. Teams do this without noticing, because pasting the real thing is the fastest way to get v0 to build the right screen.
How to check
Open the project in v0 and scroll the chat from the very first message. Look at every attachment and every pasted block for real names, dates of birth, member or record numbers, addresses and patient photos. Write down the date of the earliest one you find.
The Model Training setting on your v0 account
Highv0's Privacy Policy makes the handling of your inputs and outputs depend on which plan you are on and whether you opted in or out of Model Training. That setting is easy to have never opened, in which case you do not know which of those states you are in.
How to check
Open your v0 account settings, find the Model Training control, and read its current state. Then confirm which plan the account is on: Hobby, trial Pro, or paid Pro. Screenshot both. That screenshot is the only record you will have of what the setting was on a given date.
Preview deployments
HighEvery push to a branch other than production produces a preview deployment on a vercel.app URL. If that preview reads the production database, the preview is serving live records. If deployment protection is off, anyone holding the link can open it.
How to check
In the Vercel dashboard, open the project, filter Deployments to Preview, and open the newest one in a private browser window. If it loads without a login and shows real records, you have both problems at once. Then open Settings and compare the preview environment variables against production — if the database URL is the same string, previews are pointed at live data.
Runtime and function logs
MediumGenerated route handlers frequently log the incoming request or the object they just wrote. That is harmless until the object is a patient. Those lines land in the project's logs, where retention and access are separate from your application's own access controls.
How to check
Open the project's Logs in the Vercel dashboard, set the range to the last 24 hours, and search for a field name your app actually uses — "patient", "dob", "mrn", "email". Anything that comes back is PHI sitting outside your database.
Sample and seed data left in the generated code
Mediumv0 scaffolds screens against placeholder arrays. The common failure is that someone replaced the placeholders with a slice of a real export so the demo would look convincing, and that file is now in the repository and in every deployment.
How to check
Search the repository for the mock or sample data files v0 created and read the rows. If any row belongs to a real person, it is in your commit history too, not only in the current file.
Third-party services wired into the generated app
MediumAnalytics, error tracking, email and SMS integrations receive whatever the app hands them, and an error report can carry a full request body. Each of those vendors is a separate company with a separate agreement, and the Vercel BAA does not reach them.
How to check
Open the project's environment variables in the Vercel dashboard and list every external service named there. For each one, answer a single question: do we have a signed BAA with this company? Then search the code for the error-reporting call and read what it sends.
Six questions to answer before you call anyone
Each of these is answerable yes or no from the v0 project and the Vercel dashboard — five of them in about a minute, and the first in as long as it takes to scroll back through the chat history. Answer them honestly. Nothing here is sent to us.
01Has real patient data — a name, a date of birth, a record number, a chart screenshot, a data export — ever been pasted or uploaded into the v0 chat?
02Is a HIPAA BAA with Vercel in place today — one you can produce as a signed agreement, or see charged on the account that hosts the app?
03Do your preview deployments read from the same database as production?
04Does the newest preview URL open in a private browser window without asking you to log in?
05Searching the last 24 hours of runtime logs for one of your own PHI field names, do any lines come back?
06Does the app send data to any third party — analytics, error tracking, email, SMS — that you do not have a separate signed agreement with?
What we do about it
Typical range
$13,000–$25,000
Typical timeline
6–10 weeks
- 01
Map the surfaces
1 weekA written data-flow map: every place PHI currently travels — v0 chat history, preview deployments, logs, third-party services, seed data — each marked as covered by a signed agreement or not, with the evidence beside it.
- 02
Close the contract gaps
3–5 daysThe Vercel HIPAA BAA add-on active on the account that actually hosts the application, a dated screenshot of the Model Training setting, and a list of every remaining vendor in the data path with the status of its agreement.
- 03
Separate v0 from production data
2–3 weeksA synthetic dataset that previews and development run against, disconnected from the production database, plus deployment protection on preview URLs — verified by opening the newest preview in a private window and getting a login wall.
- 04
Clean the prompts and the logs
2–3 weeksGenerated route handlers and client components with PHI removed from logs and error reports, with a redaction layer in front of anything that leaves the application — verified by a search across seven days of runtime logs that returns nothing.
- 05
Write the rules for continued v0 use
2–3 daysA one-page working agreement your team follows the next time someone opens v0: what may be pasted, what may not, which files v0 is allowed to touch, and who checks the preview settings after a merge.
- 06
Hand over the evidence pack
3–5 daysA dated pack — configuration screenshots, the data-flow map, and the vendor terms as they read on the day we checked them — that you can hand to your lawyer or an auditor without us in the room.
What moves the number
- How many surfaces already hold PHI — a chat history full of real records takes far longer to reason about than a clean one.
- Whether production data has to be moved off a service that has no agreement behind it.
- How many third parties are in the data path and need their own agreements, or need removing.
- Whether authentication and per-user access control have to be rebuilt, or only tightened.
- Whether this is one v0 project or several that grew apart and now share a database.
When not to hire us
- You are still on synthetic data. A prototype full of invented patients needs none of this. Build it — our free build guides at /how-to-build-v0 and starter playbooks at /v0-template cover that part — then come back before the first real record goes in, which is the cheapest moment to do this work.
- You only need the BAA. Vercel's Pro plan documentation lists it as a paid add-on at $350/month, so it is a purchase you make directly with Vercel. Paying an agency to arrange that would be silly.
- Your problem is a broken v0 build rather than patient data — a failing deploy, a missing component, an integration that will not connect. We publish those fixes free at /v0-issues, and the integration write-ups at /v0-integrations, and you should use them instead.
- Your budget is below $13,000. We would rather tell you that now than on the third call.
Worth knowing either way
There is no government HIPAA certification
No authority certifies software as HIPAA-compliant. What exists is a signed Business Associate Agreement with every vendor that touches protected health information, plus the administrative, physical and technical safeguards you implement and document yourself.
SOC 2 is not a substitute for a BAA
Supabase states it plainly in its own documentation: “SOC 2 does not cover, nor is it a substitute for, compliance with the Health Insurance Portability and Accountability Act (HIPAA).” The same holds for every vendor here.
An absence of documentation is not a vendor promise
Several answers here rest on what vendor documents do not say. We name which documents we read and when. A vendor that has never published a HIPAA position may still decline to sign, and one that publishes nothing today may publish something next quarter.
The same question, for the other fifteen tools
Firebase
NoOnly the Google Cloud equivalents are covered — no Firebase-branded service is
Supabase
Yes, with conditionsBAA plus a paid HIPAA add-on, on the Team plan or above
v0 by Vercel
PartiallyVercel hosting is covered; v0 itself is contractually off-limits for PHI
Lovable
NoIts terms prohibit uploading protected health information
Bubble
NoIts own documentation says apps built on Bubble won't achieve compliance
Replit
NoIts Terms, Commercial Agreement and DPA carry no HIPAA or BAA terms
Bolt.new
NoNo BAA in the StackBlitz and Bolt documents we read; HIPAA is named only for self-hosted
FlutterFlow
NoIts terms bar processing HIPAA-protected data outright
Claude Code
Yes, with conditionsCovered only with zero data retention, on accounts Anthropic qualifies
Codex
Yes, with conditionsCodex Local on a Regulated or Healthcare tier; Codex Cloud is excluded
Cursor
Yes, with conditionsEnterprise only, with Privacy Mode locked organisation-wide
GitHub Copilot
NoNo BAA offered; the Data Protection Agreement tells customers not to send PHI
Devin
NoPHI is Prohibited Data under the acceptable-use policy
Hermes Agent
Not the right questionSelf-hosted — the agreement you need is with your model provider
OpenClaw
Not the right questionSelf-hosted — but the vendor-run router still receives prompts
Base44
NoNo BAA; its terms ask customers to keep PHI off the platform
Sources, quoted exactly
Every quote below is copied character-for-character from the vendor page named beside it. Source dates are printed the way the vendor prints them; "verified on" is when we last opened the page ourselves.
Vercel's API Terms prohibit processing protected health information through the v0 API or AI Solution.
You agree not to use the v0 API or AI Solution to create, receive, maintain, transmit or otherwise process any information that includes or constitutes "Protected Health Information," as defined under the HIPAA Privacy Rule (45 C.F.R. Section 160.103).
Vercel API TermsSource dated: Last Updated July 8, 2025 (AI Product Terms: March 17, 2026, effective March 31, 2026)Checked: August 2026A HIPAA BAA is available as a paid add-on on the Vercel Pro plan at $350 per month.
- [HIPAA BAA](/docs/security/compliance#hipaa): Healthcare compliance agreements for $350/month
The BAA covers Vercel's hosting infrastructure globally.
Vercel's HIPAA BAA covers our entire global infrastructure, and that coverage gives healthcare organizations several advantages.
Vercel Secure Compute is described as available on Enterprise plans, so it is not part of the Pro add-on.
Customers subject to HIPAA may enable Vercel Secure Compute (available on Enterprise plans) for additional layers of protection.
Whether your v0 inputs and outputs are used for model training depends on your plan and your opt-in or opt-out state.
If you are (a) on a Hobby plan or a trial Pro plan, and have opted out of Model Training … or (b) on a paid Pro plan and have not opted in to Model Training … we will not use or share the content you input and output through our AI products for Model Training
v0 Privacy PolicySource dated: Last Updated March 17, 2026; Effective March 31, 2026Checked: August 2026
Frequently asked questions
Can I just pay the $350 and keep using v0 the way I have been?
No. The add-on and the restriction live in two different documents. The Pro plan add-on gets you a BAA covering Vercel's hosting infrastructure. The API Terms separately say you agree not to process Protected Health Information through the v0 API or AI Solution, and paying for the first does not edit the sentence in the second. The practical version: buy the add-on for your deployed app, and keep real patient data out of the v0 chat.
So does the BAA cover v0, or only hosting?
Vercel's own guide says the HIPAA BAA covers its entire global infrastructure, which is about where your application runs. The API Terms then place a specific restriction on what you may put through v0 itself. That is why this page gives a split answer rather than a single yes or no: hosting the finished application and generating it on real data are two separate questions with two different answers.
We already pasted patient data into v0 months ago. What do we do now?
Technically, you cannot recall it. What you can do this week: stop the practice, write down the date range and what kinds of records went through, open your v0 account settings and record the current Model Training state with a screenshot, and take that written record to your own counsel. Whether it is a reportable event is a legal determination, and not one we make.
Would an Enterprise plan let us use v0 with real patient data?
Not on the strength of anything we could find. We read the v0 Enterprise Addendum in full (Last Updated: August 20, 2025), and the terms "Protected Health Information", "PHI", "HIPAA" and "160.103" do not appear anywhere in it, so nothing in that document removes the API Terms restriction. If a Vercel salesperson tells you otherwise, ask for it in writing and have your counsel read it against the API Terms.
Is v0 HIPAA certified?
Nothing is. There is no government HIPAA certification for any product, so any vendor or agency describing itself as "HIPAA certified" is describing something that does not exist. What does exist is a signed business associate agreement with each vendor that touches PHI, plus the administrative, physical and technical safeguards you run on your side.
Do we need Vercel Secure Compute on top of the BAA?
Vercel's compliance documentation says customers subject to HIPAA may enable Vercel Secure Compute for additional layers of protection, and describes it as available on Enterprise plans. It is not included in the $350/month Pro add-on. Whether you need it depends on your own risk decisions and your network requirements. It is an additional layer, not the thing that makes the BAA valid.
Can we use v0 at all if we are building something for healthcare?
The restriction in the terms is about the data, not about the tool. The pattern that fits it is to design and generate in v0 using synthetic records shaped like your real ones, and keep actual patient data in the deployed application running on infrastructure covered by the BAA. That split is most of what we implement on these projects, and the hardest part is not the code — it is the habit of never pasting the real spreadsheet in to make a demo look right.
This page is technical information rather than legal advice: HIPAA compliance is a property of your whole system and how you operate it, not of any single tool, and vendor terms change — verify the current terms on the vendor's own pages, and take anything that turns on them to a qualified healthcare-privacy attorney.
