--- title: Does Vercel support HIPAA compliance? description: Learn about Vercel and HIPAA compliance. url: /kb/guide/is-vercel-hipaa-compliant canonical_url: "https://vercel.com/kb/guide/is-vercel-hipaa-compliant" published: 2025-11-03 last_updated: 2025-11-10 authors: Sam Ko related: - /docs/security/shared-responsibility install_vercel_plugin: npx plugins add vercel/vercel-plugin --- ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [Security & Compliance Measures](https://vercel.com/docs/security/compliance?from=related) — Learn about the protection and compliance measures Vercel takes to ensure the security of your data, including DDoS miti - [How to build and maintain HIPAA-compliant applications on Vercel](https://vercel.com/kb/guide/hipaa-compliance-guide-vercel?from=related) — Deploy HIPAA-compliant healthcare apps on Vercel with built-in security, BAAs, and scalable serverless infrastructure. - [Overview](https://vercel.com/docs/security?from=related) — Vercel provides built-in and customizable features to ensure that your site is secure. - [Legal](https://vercel.com/docs/connect/legal?from=related) — Product terms governing your use of Vercel Connect, including Customer Managed Connectors, Vercel Managed Connectors, an - [Enterprise Plan](https://vercel.com/docs/plans/enterprise?from=related) — Learn about the Enterprise plan for Vercel, including features, pricing, and more. - [Privacy](https://vercel.com/docs/analytics/privacy-policy?from=related) — Learn how Vercel supports privacy and data compliance standards with Vercel Web Analytics. - [Does Vercel support PCI compliance?](https://vercel.com/kb/guide/is-vercel-pci-compliant?from=related) — Learn about Vercel and PCI compliance. - [Is Vercel certified under DPF?](https://vercel.com/kb/guide/is-vercel-certified-under-dpf?from=related) — The EU-U.S. Data Privacy Framework \\(DPF\\) enables secure data transfers from the EU, UK, and Switzerland to the U.S. Ve - [Does Vercel have a SOC 2 Type 2 attestation?](https://vercel.com/kb/guide/is-vercel-soc-2-compliant?from=related) — Vercel holds a SOC 2 Type 2 attestation for Security, Confidentiality, and Availability. See what the report covers, how - [Ensuring safe and effective infrastructure testing](https://vercel.com/kb/guide/ensuring-safe-and-effective-infrastructure-testing?from=related) — We conduct regular penetration testing through certified third-party assessors to secure the Vercel platform. This guide Full cross-link map for this page: [/kb/guide/is-vercel-hipaa-compliant.graph.md](/kb/guide/is-vercel-hipaa-compliant.graph.md) Vercel supports HIPAA compliance for Pro and Enterprise customers. Our HIPAA report is available upon request at [security.vercel.com](https://security.vercel.com/). ## What is HIPAA? The [Health Insurance Portability and Accountability Act (HIPAA)](https://www.hhs.gov/hipaa/index.html) is a federal law that requires certain businesses to adhere to a set of privacy and security standards that protects the confidentiality, integrity, and availability of [protected health information](https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html#:~:text=Information%20is%20Protected-,Protected%20Health%20Information.,health%20information%20\(PHI\).%22) (PHI). ## Does Vercel process protected health information (PHI)? With Vercel’s [shared responsibility model](https://vercel.com/docs/security/shared-responsibility), Vercel’s records may contain healthcare information that can include data relevant to PHI based on the customers’ configuration. Any additional data captured within the system is at the discretion of Vercel’s customers. Vercel itself does not manage or review this data. Vercel is responsible for helping ensure that the customer data is stored in their systems securely and remains available for their use. ## Vercel as a Business Associate Vercel serves as a business associate to customers that meet the definition of a [covered entity](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) under HIPAA (i.e. health plans, healthcare providers, etc.). A business associate performs certain functions or services that involve the use or disclosure of PHI on behalf of a covered entity. Covered entities may be required to enter into a Business Associate Agreement (BAA) with business associates to meet their HIPAA requirements. For Enterprise customers subject to HIPAA and processing PHI within their websites or applications, Vercel will sign a BAA. To request Vercel’s BAA, please [contact us.](https://vercel.com/contact/sales/security) For Pro customers, the BAA is a click through agreement that is not signed. You can access it [here](https://vercel.com/legal/baa).