Question 1

What BAAs do we need, and who signs them?

Accepted Answer

You need a BAA with every cloud and SaaS vendor that processes, stores, or transmits PHI on your behalf. Typically: AWS or GCP (cloud infrastructure), Supabase (database), any email service handling PHI (Resend supports BAA), any video conferencing tool used for clinical visits. We document the BAA chain in every infrastructure engagement.

Question 2

Is Supabase HIPAA compliant?

Accepted Answer

Supabase offers HIPAA compliance on its paid plans with a signed BAA. The compliance is at the infrastructure layer — PHI encryption, access controls, and audit logging must still be implemented at the application layer. We build Supabase deployments with RLS, Vault for sensitive fields, and audit logging as standard.

Question 3

What is the difference between HIPAA compliance and SOC 2?

Accepted Answer

HIPAA is a US regulatory requirement for covered entities and business associates handling PHI. SOC 2 Type II is a voluntary third-party audit of security controls based on the AICPA Trust Services Criteria. They are complementary — enterprise healthcare customers often require both. HIPAA-ready architecture is a precondition for SOC 2 readiness in a healthcare context.

Question 4

Do you handle FedRAMP requirements for government healthcare contracts?

Accepted Answer

FedRAMP authorization is a separate, lengthy process (12–24+ months). We can build infrastructure that is architecturally aligned with FedRAMP High requirements (VPC design, encryption, audit logging, access controls), but formal FedRAMP authorization requires a 3PAO assessment and NIST 800-53 controls implementation at a level beyond a typical Studio engagement.

Question 5

How do we test our infrastructure for HIPAA readiness before going live?

Accepted Answer

We deliver a HIPAA controls matrix with every infrastructure engagement, mapping each HIPAA Technical Safeguard to its implementation. We also conduct a pre-launch review of: encryption verification, IAM policy audit, CloudTrail log testing, vulnerability scan results, and breach notification runbook walkthrough. Third-party penetration testing is recommended and can be scoped separately.

HIPAA Cloud Infrastructure

Four pillars of this capability.

HIPAA-Aligned Architecture

Identity & Access Management

Audit Logging & Monitoring

Incident Response Readiness

Deliverables for every engagement.

HIPAA Cloud Infrastructure by industry.

The productized version of this capability.

Frequently asked questions.

Ready to build this capability?