On this page
A lot of teams hear "HIPAA-compliant no-code" and assume there is a single checkbox somewhere. There is not. HIPAA is a set of administrative, physical, and technical safeguards — and the platform you pick can take a big chunk of them off your plate. Here is the honest version.
Building a healthcare app? Describe it — we’ll build it now.
We started the prompt for you. Edit it, or describe your own app.
What Tadabase covers for you #
- Infrastructure — encrypted at rest, TLS in transit, controlled physical access.
- A Business Associate Agreement (BAA) available on the appropriate plans.
- Audit log of platform-level access.
- Role-based access control and row-level security to enforce the minimum-necessary principle.
What you still own #
- Your role and access policy — who gets to see what, and why.
- Your training and operational policies — HIPAA is half people, half tech.
- Your audit reviews — Tadabase logs it, you review it.
- Workforce access reviews — periodic checks that the right people still have the right roles.
Design rules for PHI inside Tadabase #
- Treat every component's filter as a security control. "Show records where Patient = logged-in user" is the law.
- Use field-level controls to hide PHI fields from roles that do not need them.
- Audit every workflow that touches PHI — log the actor and the change.
- Avoid exporting PHI via uncontrolled paths (public links, unscoped Pipes, etc.).
A note on AI-generated apps #
Vibe-generated apps inherit Tadabase's permission model when they read and write through the Domain API with the user's session. That means the RLS you defined in Tadabase still applies on the Vibe side — you do not have to re-implement it in the generated code. That is the whole point of treating Tadabase as the system of record.