Your Patient Data Sits on Servers Built for Shopify. That's Your HIPAA Problem.

No. AWS offers HIPAA-eligible services and will sign a BAA, but compliance is shared responsibility. You still have to correctly configure encryption, access controls, audit logging, and network isolation yourself. Running on AWS doesn't make your application HIPAA-compliant -- the configuration and your operational procedures are what actually matter.

A BAA is a legally required contract between a covered entity and any vendor that handles PHI on their behalf. AWS, Azure, and Google Cloud all offer BAAs, but each one covers only specific services within their platform. Using a service that isn't covered by a BAA to process PHI is a compliance violation -- regardless of whatever else you have in place.

Vercel and Netlify don't currently sign BAAs, so they can't host applications that process or store PHI. That said, you can use them for static frontend assets that contain zero PHI while running your backend and database on BAA-covered AWS, Azure, or Google Cloud services. It's a workable split, as long as the boundary is clean.

Monthly infrastructure costs typically land between $500 and $5,000 depending on compute, storage, and data transfer. The bigger number is usually the upfront architecture and configuration work. Cutting corners on setup to trim monthly costs is exactly how breaches happen. Our fixed-fee setup makes sure the foundation is audit-ready before anything goes live.

If your data meets all 18 Safe Harbor de-identification criteria under 45 CFR 164.514, it's no longer PHI and HIPAA's technical safeguards don't apply. Partial de-identification doesn't cut it -- one remaining identifier and you're back to full PHI treatment. We'll help you verify your de-identification methodology before you make that assumption.

The Office for Civil Rights asks for risk assessments, technical safeguards documentation, BAAs, access logs, breach response procedures, and employee training records going back six years. Our compliance documentation package is structured to answer those requests without the last-minute scramble. And because everything is infrastructure-as-code, every configuration decision is traceable and defensible.