Tools that sign a HIPAA BAA in 2026: registry for health app stacks

TL;DR

The tools that sign a HIPAA BAA in 2026 cover almost every layer of a health app stack, often only from a paid or sales-led tier, and four common ones are off-limits for PHI. We checked 24 services against their own HIPAA pages, BAAs and covered-product lists on November 6, 2026.

• 18 of the 24 sign a business associate agreement in some form, from a click in AWS Artifact to Twilio's Security or Enterprise Edition.
• SendGrid, Postmark, Google Analytics and Contentful will not take PHI. Paubox, Mailgun's addendum and BAA-covered analytics replace them.
• Firebase is covered only through Google Cloud products such as Firestore and Cloud Storage. No product is listed under the Firebase name.
• HHS says a cloud provider that stores only encrypted ePHI is still a business associate, even without the key.

Your stack has more business associates than your contract list

A health app rarely sends PHI to one vendor. It goes to the database, the SMS gateway, the email relay, the push service, the analytics pipeline, the error tracker and now the language model. Each one that stores or transmits PHI for you is a business associate and needs its own agreement.

That chain is where breaches happen. The HIPAA Journal counted 710 large healthcare breaches in 2025, and 35.8% of them occurred at business associates.

The Security Rule rewrite would reopen every BAA

HHS published its proposed Security Rule overhaul on January 6, 2025. Per McDermott Will & Schulte, it would make regulated entities revise their business associate agreements and get written verification at least once every 12 months that business associates deploy certain technical safeguards. The 2026 Unified Agenda lists July 2027 for final action.

A contract signed this quarter will still run then. Ask each vendor below how it will deliver the yearly check.

How we built the registry

On November 6, 2026 we read each vendor's own HIPAA page, BAA, eligibility article or covered-products list, and recorded four things:

1. Whether it signs a BAA, in the vendor's words.
2. The plan, edition or route that gets you one.
3. The limits the vendor states.
4. A replacement, where the vendor does not sign.

Terms change, so confirm on the linked page before you sign.

The BAA registry at a glance

Cloud and backend: AWS, Google Cloud, Firebase, Azure, Supabase, MongoDB Atlas

The hyperscalers sign for any account. AWS has you accept the BAA in AWS Artifact and keep PHI in HIPAA-eligible services. Microsoft offers its BAA in the Product Terms "by default" to covered entities and business associates.

Firebase is the trap. Google's HIPAA page lists Firestore, Cloud Storage, Cloud Run functions and Identity Platform, and nothing under the Firebase name, so Analytics, Crashlytics and Cloud Messaging stay PHI-free. Even Identity Platform has a condition: no PHI through its SDKs or client libraries.

Supabase needs a signed BAA, its HIPAA add-on, point-in-time recovery, SSL enforcement and network restrictions; self-hosting is out of scope. MongoDB Atlas includes the BAA in its Cloud Terms for self-serve accounts.

Messaging and email: Twilio, SendGrid, Mailgun, Postmark, Paubox, OneSignal

Twilio says "HIPAA Accounts require Twilio Security Edition or Enterprise Edition," sold through sales. Its eligible services list covers Programmable SMS, Voice, Verify, Conversations and Segment, not SendGrid. Our chat API comparison covers in-app chat.

Email splits three ways. SendGrid answers "No, we are not," and Postmark cannot sign BAAs. Mailgun's HIPAA addendum covers PHI, but Mailgun does not encrypt the data you upload and sends even when the recipient lacks TLS. Paubox includes a BAA with every account.

OneSignal offers its BAA to Enterprise Plan customers only. On other plans, a push should say a message is waiting, never what it says.

Analytics: Segment, Mixpanel, Amplitude, PostHog, Google Analytics

Analytics leaks PHI nobody chose to send: an event named after a screen, a property holding a medication.

Twilio Segment offers BAAs on its Business Tier, and every destination you forward to needs its own. Mixpanel ties its BAA to the Enterprise Plan. Amplitude "can enter a Business Associates Agreement" and covers its AI features. PostHog signs on Boost, Scale or Enterprise, excluding PostHog AI.

Google Analytics offers no BAA and says not to tag authenticated pages. A Texas federal court vacated part of OCR's tracking guidance on June 20, 2024, but per Morrison Foerster, tracking on authenticated pages still needs a BAA.

Monitoring and AI: Sentry, Datadog, OpenAI, Anthropic

Crash reports carry request bodies, and request bodies carry PHI. Sentry lets an Owner or Billing Contact accept its BAA on a non-trial Business tier or higher. Datadog signs, then bars BAA customers from Live Chat support and most third-party generative AI.

OpenAI says API eligibility "is contingent on Customer's account being provisioned with Modified Retention." Anthropic needs the Primary Owner to sign, requires 30-day retention for covered models, and leaves the Batch, Files and Skills APIs outside the BAA.

Identity, content and payments: Auth0, Contentful, Stripe

Auth0 "can provide its Business Associate Agreement to you upon request," though not on Azure deployments. Contentful's acceptable use policy bans regulated data, naming health information. Patient education content is fine; patient answers are not.

Stripe needs no BAA to move money: the HHS business associate FAQ excludes card processing. A diagnosis in a charge description is PHI sent to a party that never signed. Our payments guide draws that line.

Encrypted ePHI without the key: what HHS says

If you encrypt on the device and the vendor never holds the key, you still need its BAA. The HHS cloud computing guidance says a provider is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data."

Encryption protects confidentiality, but it "does not maintain the integrity and availability of the ePHI," so the provider still has duties. The conduit exception covers transmission only, and storage disqualifies a vendor "even if the CSP does not actually view the information."

Encryption still pays in two places. Data encrypted to HHS standards falls in the breach safe harbor, unless the key leaked too. And the BAA can assign authentication and user identification to you. Segment shows the pattern: it does not save your encryption key, yet still requires its Business Tier BAA. Offshore storage follows the same logic, as our data residency guide explains.

Shared responsibility: what the BAA leaves to you

Twilio: "Signing a BAA alone does not make your application HIPAA-compliant." Google: "Complying with HIPAA is a shared responsibility between you and Google." HHS asks provider and customer to "each confirm in writing" who meets which duty.

What stays yours:

• The risk analysis for each provider you rely on.
• Access control, individual logins and audit logs inside your app.
• Minimum necessary. Sentry's BAA asks you to use its own tools to meet it.
• The chain: Segment destinations, push providers and AI subprocessors each need an agreement.
• Evidence. HIPAA does not require providers to hand over security documentation, so contract for audit rights.

Which replacement fits your stack

• On Firebase: move PHI to Firestore and Cloud Storage under the Google Cloud BAA, with Identity Platform for sign-in.
• Appointment or result emails: Paubox, or Mailgun with your own encryption.
• Analytics on logged-in screens: PostHog, Mixpanel or Amplitude under a BAA.
• Push below OneSignal Enterprise: a content-free alert.
• LLM features: the OpenAI API with Modified Retention, or the Anthropic API under its BAA.

What our healthcare pipeline shows

These shares come from healthcare and telehealth companies that evaluated custom development with us. A pattern counts only when at least three companies raised it independently. Around 15% named specific third-party services in their requirements: cloud hosting, messaging, email, a CMS and Firebase.

One device company listed a headless CMS for patient education and a transactional email service in one request. Another buyer's Android app already stored test results in Firebase. Neither request mentioned a BAA or a plan tier. That is the expensive order: vendor first, agreement later.

Our view: choose the BAA tier before the SDK

Most stacks are assembled from free tiers during the prototype, and the HIPAA review happens at launch. By then the SDK is wired into every screen, and a vendor that refuses a BAA costs a rewrite.

Reverse the order. List every service that will see a patient identifier, find its BAA route above, and price that tier instead of the free one. Then ask each signer how it will prove its safeguards every year.

Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline records behind this article's healthcare buyer section sit in the operations he oversees.

Planning a health app stack? Get the vendor map first

Send us the services your app uses or plans to use. We will mark which ones sign a BAA, on which tier, which ones need a replacement, and where PHI should never reach.