On this page
Short answer: most AI app builders do not sign a Business Associate Agreement (BAA), and without one you may not put protected health information (PHI) in the app they host. Of the ten platforms below, four sign a BAA today (Caspio, Knack, Tadabase AI and, for hosting only, Vercel behind v0), and each of them sells it as a separate tier or add-on rather than including it in the entry plan. Three say nothing about HIPAA on their security pages (Base44, Emergent, Replit as far as their pages render), one forbids PHI in its terms (Lovable), one points you at running it in your own cloud (Bolt), and one claims a HIPAA audit but does not mention a BAA on its product page (Zoho Creator). Every cell in the table was read on the vendor's own site on 2026-09-22 and links to where it was read. Check it again before you sign anything.
Building a healthcare app? Describe it — we’ll build it now.
We started the prompt for you. Edit it, or describe your own app.
Why the BAA is the question to ask #
HIPAA has no certificate. The U.S. Department of Health and Human Services does not certify software, so a badge that says "HIPAA compliant" is a marketing claim, not a status. What a vendor can do is sign a BAA: a contract in which it accepts the obligations of a business associate for the PHI it stores, processes or transmits on your behalf. If the vendor will not sign one, PHI cannot legally live there, however good the encryption is.
That makes the BAA the fastest filter when you compare app builders for a clinic, a practice, a health plan or any SaaS that serves them. Before you compare features, ask three things: Will you sign a BAA? On which plan? What does that plan cost? The table below answers those three for the platforms people compare most often in 2026.
The table: who signs a BAA, on which plan, at what price #
| Platform | Signs a BAA? | On which plan | Listed price of that plan | Read on (2026-09-22) |
|---|---|---|---|---|
| Tadabase AI | Yes | HIPAA-eligible plans; the BAA is included on those plans | See the pricing page | tadabase.com/ |
| Caspio | Yes | HIPAA/ | $500/ | caspio.com/ |
| Knack (Knack Health) | Yes | HIPAA Starter and HIPAA Core, sold as Knack Health | HIPAA Starter from $499/ | knack.com/ |
| v0 (Vercel) | Hosting only | Vercel signs BAAs with eligible Pro (paid add-on) and Enterprise customers; v0's own security page does not mention HIPAA or a BAA | Not listed on the pages read | v0.app/ |
| Zoho Creator | Not stated | Product page says the platform is "independently audited and certified against SOC 2, GDPR, HIPAA, and HDS"; no BAA mentioned there | Not on that page | zoho.com/ |
| Bolt | Not stated | Security page: SOC 2 Type 2; says a bring-your-own-cloud deployment inside your AWS or Azure tenant can meet HIPAA requirements; no BAA mentioned | Not on that page | bolt.new/ |
| Lovable | No standard BAA found | Terms: you agree not to provide PHI "unless your plan or a separate written agreement with us ... expressly permits it"; security page lists SOC 2 and GDPR support, no HIPAA | Not on those pages | lovable.dev/ |
| Base44 | Not stated | Security page: SOC 2 Type II, ISO 27001, GDPR; no HIPAA or BAA statement | Not on that page | base44.com/ |
| Emergent | Not stated | Pricing page: SOC 2 and ISO 27001 badges; no HIPAA or BAA statement on any plan | Not on that page | emergent.sh/ |
| Replit | Not stated | Its security page and trust center did not render for our reader; the security docs we could read do not mention HIPAA or a BAA | Not on the pages read | replit.com/ |
Three patterns fall out of the table. First, a BAA is always a paid tier or add-on, never part of a free or starter plan; the honest comparison is therefore between the HIPAA tiers, not the headline prices. Second, the AI-first code generators (Lovable, Bolt, Base44, Emergent, Replit) publish SOC 2 or ISO badges but stay silent on HIPAA, because their model is to hand you code you host and secure yourself. Third, the platforms that do sign (Caspio, Knack, Tadabase AI) are the ones that run the backend for you, which is where PHI actually sits.
A signed BAA is the start, not the finish #
A BAA moves the platform's share of the work to the platform: encrypted storage, isolated tenancy, subprocessor agreements, breach notification. It does not do your share. Whoever builds the app still has to decide which tables hold PHI, who may see which rows, what gets logged, when sessions time out, and who is trained. A platform is honestly described as HIPAA-eligible when it signs the BAA and gives you working controls for that second half. Compliance is what you have when both halves are done.
- The platform's half: encryption in transit and at rest, tenant isolation, BAA-covered hosting, BAAs with its own subprocessors, backups, breach detection and notification.
- Your half, with the platform's tooling: flagging which tables and fields are PHI, granting the minimum access per role, keeping the audit trail on and reading it, setting auto-logoff and two-factor sign-in, doing and writing down the risk analysis, training the workforce.
- The AI's half, if the builder has one: an in-app agent that can read records is a PHI reader too. Ask whether it is scoped by the user's role, whether its reads are logged, and whether it can be kept away from exports, PDFs and reports that would leak PHI sideways.
How Tadabase AI handles it #
Tadabase AI is HIPAA-eligible: on eligible plans we sign a BAA, run your app on BAA-covered AWS infrastructure, and give you the controls a compliant deployment needs. You can switch HIPAA on for an existing app without rebuilding it. Once an app is flagged, the Compliance Center checks it against its readiness requirements before every publish: PHI tables flagged, deny-by-default row-level security on each of them, secure file fields, access logging on, BAA-covered hosting. A configuration that fails the check cannot reach production.
- Row-level security enforced server-side, on every query, so "who can see a patient record" is not a filter in generated front-end code.
- A PHI access log that records the user, action, table, record, source IP and result, and the names of the fields touched. Values are never written to the log.
- Security controls set by HIPAA setup: auto-logoff, two-factor sign-in for your end users, and a password policy.
- Secure file fields for documents that carry PHI.
- An AI that respects the same rules. The in-app agent works under the signed-in user's permissions, its reads are logged separately from human reads, and on HIPAA apps it is blocked from saved views, reports, exports and PDFs that could leak PHI around the row-level rules. Agent runs spend AI credits, and the app owner controls whose credits a shared run uses.
- The paperwork layer, tracked in-product: the account BAA on record, Security and Privacy Officials assigned, breach contacts, workforce-training acknowledgments.
Five questions to ask any builder before you put PHI in it #
- Will you sign a BAA, and can I read it before I pay? A vendor that signs should be able to send the document on request.
- Which plan includes it, and what does that plan cost per year? Add-ons with annual terms change the real price.
- Where does my app run, and is that hosting under the BAA? If the builder hands you code to host elsewhere, the BAA you need is with the host, not the builder.
- Is access control enforced on the server, and is PHI access logged? Ask to see the log format. If values are logged, the log itself is PHI.
- What does your AI see? If there is an agent, ask whether it is scoped by role, whether its reads are logged, and whether prompts leave the BAA-covered boundary.
Common questions #
Do I need a BAA if I only store appointment times and names? A name next to an appointment with a provider is PHI. If a covered entity or its business associate is involved, yes.
Is a SOC 2 report the same as HIPAA? No. SOC 2 is an audit of a vendor's security controls against the AICPA criteria. HIPAA is a law with specific obligations, and the BAA is how a vendor accepts them. A vendor can have SOC 2 and refuse to sign a BAA; several in the table do.
Can I use an AI code generator and add a HIPAA backend later? You can, but then you need two BAAs, one with whoever hosts the generated front end and one with the backend, and you need to be sure the front end never caches, logs or processes PHI outside the covered boundary. Simpler is a platform that hosts both halves under one BAA.
Does a BAA cover the AI model too? Only if the vendor's own subprocessor BAAs do. Ask where prompts and record data go when the agent runs, and whether that path is under the agreement.
How do I start on Tadabase AI? Create an account, build the app, then turn HIPAA on for it from the Compliance Center on a HIPAA-eligible plan. The publish gate tells you what is still missing before the app can go live.