# Is Firebase HIPAA compliant? Only the Google Cloud equivalents are - Tool: Compliance - Last updated: August 2026 ## TL;DR No — no Firebase-branded service is covered by Google's HIPAA BAA. The agreement is signed with Google Cloud and covers only the products named on its Covered Products list: Firestore, Cloud Storage, Cloud Run functions and Identity Platform are on it; Firebase Authentication, Realtime Database, Hosting, Crashlytics and Analytics for Firebase are not. Moving an existing app onto the covered services takes us 6–10 weeks. ## Frequently asked questions ### We signed a BAA with Google. Doesn't that cover our whole Firebase project? It covers what the Covered Products list names, and nothing else. Google's own guidance on the same page is blunt about it: "Disable or otherwise ensure that you do not use Google Cloud Products that are not explicitly covered by the BAA (see Covered Products) when working with PHI." So a signed BAA plus PHI in Firebase Authentication or Crashlytics is not a covered arrangement — it is PHI in products the agreement does not reach. ### Everything is in Firestore already. Are we fine? Firestore is named on the covered list, so the main record store is in the right place. The question is where copies of the same data end up: the user record in Firebase Authentication, the log line in a Crashlytics report, the event parameter in Analytics, a presence node in Realtime Database. In Firebase apps the database is rarely the problem — the surfaces around it are. ### What is the difference between Firebase Authentication and Identity Platform, really? For this question, one row. Google publishes a comparison table of the two products, and on the row labelled "BAA coverage" Identity Platform reads Yes and Firebase Authentication reads No. The same table shows Identity Platform in scope for PCI-DSS and carrying a 99.95% uptime enterprise SLA, where Firebase Authentication reads No on both. ### Do we have to abandon Firebase and rebuild on something else? Usually not. The covered services are Google Cloud products, so the practical move is to stop using the Firebase-branded services for anything containing PHI and to use the products that are actually named on the list — Firestore, Cloud Storage, Cloud Run functions and Identity Platform. The user migration off Firebase Authentication is normally the largest single piece of that work. ### Is Firebase HIPAA certified? Nothing is. There is no government HIPAA certification for a product or a company — the mechanism is a signed Business Associate Agreement with each vendor that touches PHI, plus the administrative, physical and technical safeguards on your side. If a vendor or a consultancy offers you a HIPAA certificate, they are offering something that does not exist. ### How often does the covered list actually change? We do not know how often, and that is the point. The BAA text defines "Covered Services" by pointing at a web page, so the scope of your agreement follows that page rather than a document you hold. The version we read carried the stamp "Last updated 2026-08-11 UTC". Save a dated copy each time you check, and re-check at least quarterly. ### How long does the move onto covered services take? Six to ten weeks for the engagement described above, at $13K–$25K. The service map comes first and is the cheapest part; the identity migration off Firebase Authentication is the longest single stage, and a live user base is what pushes the calendar towards the upper end because the cutover has to happen without downtime. ### Can we just turn Analytics and Crashlytics off and carry on? Switching them off stops new data flowing, which is the right first move and takes an afternoon. It does not answer what is already stored, how long it is kept, or who at your company can read it — and those are the questions someone will eventually ask you in writing. If you want that traced, cleaned and written up rather than done by feel, that is the work we do; if your app is small and the answers are obvious, do it yourself. --- Source: https://www.rapidevelopers.com/compliance/is-firebase-hipaa-compliant © RapidDev — https://www.rapidevelopers.com/compliance/is-firebase-hipaa-compliant