1

I am building a project that needs to store some patient data, and it should work with HIPAA compliance since it this is medical information.

is it possible to do this using firebase databases like cloud firestore or realtime database in 2021? If so, how can I sign a BAA for cloud firestore?

Abraham
  • 12,140
  • 4
  • 56
  • 92
  • The comments on [this](https://stackoverflow.com/questions/52381369/how-can-i-achieve-hipaa-compliance-using-cloud-firestore) question suggest https://cloud.google.com/security/compliance/hipaa – Frank van Puffelen Aug 13 '21 at 14:50

2 Answers2

2

To be under HIPAA compliance the product must be aligned with ISO/IEC 27001, 27017 and 27018 certifications and SOC 2 report as mentioned here. From this document it is clear that Cloud Firestore meets all the requirements while Firebase Realtime Database doesn’t meet all the requirements and in this document Cloud Firestore is listed under the Google Cloud services in scope for HIPAA while Firebase Realtime Database is not listed. So Cloud Firestore is covered under HIPAA compliance and Firebase Realtime Database is not covered.

To execute a Business Associate Agreement (BAA) you should contact your Account Manager as mentioned here.

Prabir
  • 1,415
  • 4
  • 10
  • thanks for the info! I still have a clarification question I can't find a good answer to. There are some providers in Identity Platform (like Phone number), that when you go to configure, take you to a Firebase page. Does this mean there are some Providers in Identity Platform that are not HIPAA compliant? – Grey Mar 03 '23 at 14:38
2

It seems firestore is covered under the google cloud BAA and can be used for HIPAA compliant work. But for now, you can't use firebase auth with it, since firebase auth isn't covered under google cloud BAA.

So, using firestore with your own authentication, seems to be the option. Google cloud Identity Platform is also covered under the BAA. more info

Abraham
  • 12,140
  • 4
  • 56
  • 92
  • 1
    It's worth mentioning that you can upgrade Firebase Auth to Google Identity Platform to gain this compliancy. https://stackoverflow.com/a/62868428/2399238 – Codelicious May 08 '22 at 17:31