Is Prisma Postgres HIPAA compliant?
Managed Postgres database from Prisma. Prisma signs a BAA for workspaces on the Business plan ($129 a month); the BAA covers Prisma Postgres databases in that workspace, not every Prisma product. The published sample BAA is written for customers that are themselves business associates, so a practice should confirm Prisma will sign one for its role.
Prisma Postgres signs a Business Associate Agreement only under specific conditions. Prisma signs a BAA with Business-plan customers before they store PHI. You upgrade the workspace to Business, then email compliance@prisma.io from the account email with company and signatory details; Prisma sends the BAA for e-signature.
A BAA alone does not make its use HIPAA compliant: set it up as described under What to configure, and cover it in your risk analysis.
Source: Prisma — HIPAA compliant Postgres for healthcare apps · checked
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
BAA details
| Signs a BAA | Conditional | Prisma — HIPAA compliant Postgres for healthcare apps |
|---|---|---|
| Plans that include a BAA | Business ($129 a month, including 50 million database operations a month — then $1 per million — and 100 GB storage) | Prisma — Pricing |
What you still have to configure
- Keep PHI only in Prisma Postgres databases inside the Business workspace and keep the workspace on Business while it stores PHI. Pick a US region when you create the database: the BAA requires your advance written consent before PHI is stored or transmitted outside the United States, or disclosed to people outside the United States, including people Prisma engages (Section V.O) — choosing a US region does not settle the second part. Access to the workspace, databases and connection strings, and your application, its logs and integrations, stay your responsibility. source
Limitations
- Not available on the Free, Starter or Pro plans. The BAA covers Prisma Postgres databases only; Prisma's Terms of Service say Embeddable Prisma Studio is not designed for regulated industries such as healthcare. source
- The published sample BAA applies only where the customer is a business associate of a covered entity and Prisma is its subcontractor (Recital II.D). A covered-entity practice should confirm with Prisma that it signs a BAA suited to that role before storing PHI. source
- Under the sample BAA, Prisma notifies you of a Reportable Event without unreasonable delay and no later than 15 business days after discovery (attempted but unsuccessful security incidents are covered by a standing notice, V.D(6)), and forwards access, amendment and accounting requests it receives directly from individuals within 5 days — forwarding, not answering them; build both into your own breach and access-request timelines. Prisma covers your reasonable costs of responding to an incident it reports (notices, credit monitoring, call center, attorneys), capped at $250,000 by default. source
Against our criteria
| BAA without a sales process | No — You request the BAA by email after upgrading to Business; Prisma sends it for e-signature. | Prisma — HIPAA compliant Postgres for healthcare apps |
|---|---|---|
| Safeguards managed for you | Yes — Encryption at rest and in transit, per-tenant database isolation and daily backups (kept 30 days on Business) are on by default. Prisma's HIPAA page does not describe audit logging. | Prisma — HIPAA compliant Postgres for healthcare apps |
Alternatives
- Amazon Web Services (AWS) →BAA: yes
- Aptible →BAA: yes
- Atlantic.Net HIPAA Hosting →BAA: yes
- Google Cloud →BAA: yes
- Microsoft Azure →BAA: yes
- Supabase →BAA: conditional