HIPAA compliance

[rotund ridge]

Hi Convex team! We're building a startup in the healthcare industry. Is there any plan in the future to make Convex a HIPAA-compliant officially and offering BAAs (Business Associate Agreements)?

[fierce chasm]

Thanks for posting in #1088161997662724167.
Reminder: If you have a Convex Pro account, use the Convex Dashboard to file support tickets.

    - Provide context: What are you trying to achieve, what is the end-user interaction, what are you seeing? (full error message, command output, etc.)
    - Use [search.convex.dev](https://search.convex.dev) to search Docs, Stack, and Discord all at once.
    - Additionally, you can post your questions in the Convex Community's #1228095053885476985 channel to receive a response from AI.
    - Avoid tagging staff unless specifically instructed.

    Thank you!

[blazing lake]

hi! convex is already HIPAA compliant. you can check out our certifications here. i'm not sure about Business Associate Agreements, but @dreamy phoenix will probably know more about this.

[rotund ridge]

Thanks @blazing lake

[lost turret]

We do offer BAAs, please open a support ticket if you need one

[rotund ridge]

Great! Thanks @lost turret

[indigo gazelle]

Hey folks! Sorry to revive this thread, but had a question about BAAs. @lost turret I'm evaluating if we can use Convex for a healthcare related project. Is there any additional pricing related to BAAs, or otherwise any qualifications necessary to procure one? (other than pinging support, as I imagine there's a manual element here)

[lost turret]

Hey @indigo gazelle, yes plesae open a support ticket if you need a BAA. We don’t charge additional fees for issuing BAAs.

[prisma quiver]

Hello Nicolas, how are you? just wondering if this stays the same currently? I'm recommending Convex for a SaaS in health industry and they ask me about compliance, including HIPAA. If so, what are the requirements for a Convex project to get these. Thanks in advance.

[warm pawn]

I'm not on the team, but AFAIK the same still applies. Open a support ticket to initiate the conversation (via the dashboard for Pro accounts and higher, or email to [email protected] for all others)

[dreamy phoenix]

Yep, All plans are hipaa compliant!

[prisma quiver]

Thank you and Jamie — sorry, I realise I shouldn’t tag Convex team directly in messages.

May I ask what’s needed from our side? Other platforms require the project to be “activated” on HIPAA due to infra/tech aspects and to sign/self-serve something to complete. Thanks in advance.

[warm pawn]

Like I (and others) said earlier, open a ticket to kick off the conversation.

[prisma quiver]

Oh sorry, I thought that was for existing projects. Thank you!