Builder's DayOctober 26 · SFGet tickets

Prisma Postgres for healthcare

HIPAA compliant Postgres for healthcare apps

Prisma Postgres comes with a signed Business Associate Agreement on the Business plan, encrypts your patient data, and runs your TypeScript app right next to it.

Get startedRead the BAA

Available on the Business plan, $129 a month. Compare plans

See how Prisma Postgres compares for HIPAA →

  • A signed Business Associate Agreement (BAA)
  • Encrypted at rest and in transit, isolated per tenant
  • SOC 2 Type II and ISO 27001 reports in the Trust Center

HIPAA at a glance

The short version, for your security review: what Prisma Postgres offers for HIPAA, which plan you need, and how the Business Associate Agreement works.

Does Prisma Postgres support HIPAA?

Yes. Prisma Postgres supports HIPAA compliance on the Business plan, and Prisma signs a Business Associate Agreement (BAA) with Business customers before they store protected health information (PHI).

Which plan includes HIPAA?

HIPAA is included in the Business plan at $129 a month, including usage. It is not available on the Free, Starter or Pro plans. Business also includes SOC 2 Type II and ISO 27001.

How do I get a BAA?

Read or download the BAA, sign up and upgrade your workspace to Business, then email compliance@prisma.io from your account email with your company and signatory details. Prisma sends it for e-signature.

What does the BAA cover?

The BAA covers Prisma Postgres databases in a Business workspace. Keep protected health information in services covered by your signed BAA. Embeddable Prisma Studio is not designed for regulated industries under Prisma's Terms of Service.

Prisma Postgres HIPAA facts Updated October 2026

HIPAA supportYes, with a signed BAA
PlanBusiness only
Price$129 a month, including usage. See pricing
Also on BusinessSOC 2 Type II, ISO 27001
On every planGDPR, encryption at rest and in transit, tenant isolation
BackupsDaily, kept 30 days on Business
Regions6, including 2 in the US
BAA liability cap$250,000 standard. See the BAA.
Audit reportstrust.prisma.io

What makes a database HIPAA compliant

HIPAA does not certify databases. A database is suitable for protected health information when the provider signs a BAA with you, protects the data with safeguards such as encryption, access controls and backups, and you configure and use it correctly.

Prisma Postgres gives you the provider side of that on the Business plan, so your team can spend its time on the healthcare product instead of on database operations.

A BAA signed before any PHI is stored

Encryption at rest and in transit, on every database

Each database isolated from other tenants

Daily backups you restore from the Console

Built for production healthcare workloads

The same managed Prisma Postgres thousands of teams run in production, with the controls a healthcare app needs. Connect with any Postgres client or with Prisma ORM, using standard connection strings and built-in connection pooling.

Keep patient data in the region you choose

Pick the region when you create a database: two US regions (North Virginia and San Francisco), two in the EU and two in Asia. US patient data can stay in a US region. Storing or transmitting PHI outside the United States needs your advance written consent under the BAA (Section V.O).

See all regions

Restore from daily backups

Business keeps daily backups for 30 days. Restore one from the database's Backups tab in the Console, or take your own copy any time with pg_dump.

Read the backups docs

Run your app next to the data

Host your Node.js, Bun or Next.js app on Prisma Compute in the same region as the database. Keep protected health information in your Prisma Postgres database covered by your BAA.

Learn more about Compute

Who is responsible for what under HIPAA?

HIPAA compliance is shared. Prisma secures the managed database platform, and you secure how your application and your team use it.

Prisma handles

  • Encryption of data at rest and in transit
  • Isolation between tenants' databases
  • Daily automatic backups, kept 30 days on Business
  • An internal HIPAA program: policies, risk management and staff training
  • Signing a BAA with Business customers

You handle

  • Who can access your workspace, databases and connection strings
  • Keeping PHI out of services and tools the BAA does not cover
  • Securing your own application, its logs and its integrations
  • Your own HIPAA policies, risk assessments and access reviews
  • Keeping the workspace on the Business plan while it stores PHI

Which products the BAA covers

The BAA covers Prisma Postgres databases in a Business workspace. Keep protected health information in services covered by your signed BAA. Prisma's Terms of Service state that Embeddable Prisma Studio is not designed for regulated industries such as healthcare.

HIPAA without an enterprise budget

Most managed databases put HIPAA behind enterprise plans. Prisma Postgres includes a signed BAA on Business, so early stage healthcare startups can be compliant from day one.

FeaturePrismaPrisma PostgresSupabaseSupabaseRenderRender
Signed BAAIncludedYesYes
Plan requiredBusinessTeam plus HIPAA add-onScale
Starting price per month$129$599$499
Extra HIPAA feesNoneHIPAA add-onPlus 20% on usage

Start on the Business plan, get your BAA and ship to patients, without an enterprise contract.

Get startedRead the BAA

How do I get a BAA from Prisma?

A Business Associate Agreement is the contract HIPAA requires before a vendor handles PHI for you. With Prisma it takes four steps and a few minutes of your time.

After you sign up and upgrade to Business, email compliance@prisma.io from your account email with your company and signatory details to request your BAA.

1

Read or download the BAA

Open the standard BAA or download the PDF and share it with your legal and compliance team so you know what you are agreeing to before you sign.

2

Sign up and upgrade to Business

Create a Prisma account from the Console and upgrade your workspace to the Business plan.

3

Email compliance@prisma.io

Write to compliance@prisma.io from your account email with your company name, address, workspace, and signatory name and email.

4

Sign the BAA

Prisma sends the agreement for e-signature.

Get startedRead the BAA

Build your healthcare app with Prisma

Guides for setting up, protecting and operating your database. For field-level encryption of the most sensitive columns, CipherStash works with Prisma ORM.

DocsGet started with Prisma PostgresDocsConnect to your databaseDocsBackups and restoreDocsPrototype with synthetic data using npx create-dbBlogSearch encrypted data with Prisma 8 and CipherStashBlogPrisma completes SOC 2 Type II, HIPAA, GDPR and ISO 27001 requirements

FAQ

Yes, on the Business plan. Prisma runs a HIPAA compliance program for Prisma Postgres, and Business customers can sign a Business Associate Agreement (BAA) with Prisma before storing protected health information. HIPAA is not available on the Free, Starter or Pro plans.

HIPAA comes with the Business plan at $129 a month, including usage. Spend limits let you cap your bill. There is no separate HIPAA fee. See pricing for plan details.

Yes. Prisma signs a BAA with customers on the Business plan. Read or download the BAA, sign up for Prisma and upgrade your workspace to Business, then email compliance@prisma.io from your account email with your company name, address, workspace and signatory name and email. Prisma sends the agreement for e-signature.

The BAA covers Prisma Postgres databases in a Business workspace. Keep protected health information in services covered by your signed BAA. Embeddable Prisma Studio is not designed for regulated industries under Prisma's Terms of Service.

In the region you choose when you create each database. Prisma Postgres runs in six regions: San Francisco (us-west-1), North Virginia (us-east-1), Paris (eu-west-3), Frankfurt (eu-central-1), Tokyo (ap-northeast-1) and Singapore (ap-southeast-1), so you can keep US patient data in a US region. Storing or transmitting PHI outside the United States needs your advance written consent under the BAA (Section V.O). See the full list of regions.

You are responsible for your application, who can access your data, keeping PHI out of services the BAA does not cover, and your own HIPAA policies. Prisma secures the managed database platform: encryption at rest and in transit, tenant isolation, daily backups on paid plans and its internal compliance program.

Every Prisma Postgres database is encrypted at rest and in transit. Paid plans include daily automatic backups: Starter and Pro keep them for 7 days, Business for 30. The Free plan has no backups. You restore a backup from the database's Backups tab in the Console; see the backups docs.

Yes. Prisma ORM is a library that runs inside your application, so it does not receive your data. Use it with Prisma Postgres or any Postgres database covered by your BAA, and keep PHI out of logs, error reports and query logging tools that are not covered.

Yes. The standard BAA includes a liability cap of $250,000. Read the full terms in the BAA.

In the Prisma Trust Center, which holds audit reports, policies and control details. HIPAA, SOC 2 Type II and ISO 27001 are included with the Business plan, and GDPR applies on every plan.

Audit reports in the Trust Center

SOC 2 Type II and ISO 27001 reports, policies and control details for your security review. Plan-by-plan coverage is also on the Security and compliance page.

Visit the Trust Center

Build your healthcare app on Prisma Postgres

Move to the Business plan, sign your BAA, and ship on managed Postgres that is ready for protected health information, with your app hosted right next to it.

  • A signed BAA on the Business plan
  • Encrypted, isolated, backed up daily
  • Standard Postgres underneath, no lock-in
Get startedRead the BAA