Build HIPAA-compliant apps with confidence

Ungated summary

A HIPAA checklist for your backend

HIPAA protects patient data (protected health information, or PHI) wherever your app stores, sends or processes it, and most of that happens in the backend. Whether you are building telehealth tools, wellness platforms or any app that touches health data, use this checklist to see what a HIPAA-aligned backend needs and how Xano covers each item. The full guide below goes deeper on architecture and the split of responsibilities.

1. Sign a BAA before any PHI reaches the backend

A vendor that stores or processes PHI for you needs a Business Associate Agreement (BAA). Xano signs a BAA as part of the Enhanced security add-on (HIPAA + BAA and more). HIPAA is a paid add-on on the Pro plan and included on Custom plans; see Xano pricing.

2. Isolate the environment that holds PHI

Shared infrastructure makes it harder to say where patient data lives and who can reach it. Every Xano workspace is single-tenant and containerized, on dedicated infrastructure on paid plans. Custom plans add multiple tenants for data, resource and regional isolation, and self-hosting on AWS, Azure, GCP or on-prem.

3. Encrypt PHI in transit and at rest

Data in Xano is encrypted in transit and at rest, with SSL/TLS protection. Your data lives in a standard PostgreSQL database, so it stays exportable if you ever need to move it.

4. Limit who can access PHI

Access control is the core of the HIPAA Security Rule. Xano has role-based access control at the platform and application level (roles and permissions), and enterprise SSO with GitHub, Google and Microsoft Entra ID, with SAML supported. Your team sets the auth patterns and identity stack once in the workspace rules, and every build inherits them.

5. Log every access and every change

An auditor will ask what ran, when, and on whose approval. Xano keeps audit logs of changes and activity in the workspace, full request history and version history, and enhanced API logging lets you monitor and audit API usage with customizable log retention. When an AI agent makes a change, it is attributed, timestamped and reviewable the same way a person's change is.

6. Keep only the PHI you need

Data minimization lowers risk. In Xano, PII handling is stateless, request history has an off-switch, and Xano does not train on customer data. Collect only the fields your workflow needs, and keep PHI out of logs and test data.

7. Back up and plan for recovery

Paid plans include rolling backups: 7 days on Essential and 14 days on Pro. Version history and version rollback let you return logic to a known state, not just data.

8. Decide where the data lives

Region and data residency are part of the workspace rules your team sets. For stricter requirements, Custom plans run in your own cloud or on-prem, with tenants per client or per region.

9. Review changes before they reach production

Nothing reaches production in Xano except the immutable release your team inspected and promoted through its review gates. Policy is enforced during the build, not reported after the fact, which matters when AI writes part of the code. See how AI code governance works.

10. Know what you are responsible for

A compliant platform does not make an app compliant by itself. Xano handles the infrastructure, isolation, encryption and certifications (SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, ISO 9001, HDS, HIPAA, GDPR and DPF). You decide which PHI your app collects, which endpoints require authentication, who gets which role, and how long you keep records. The guide covers this split in detail.

For the full list of certifications and what your IT team can verify, see Xano security or the Xano trust center.