Heroku is a powerful platform-as-a-service (PaaS) that allows developers to build, deploy, and scale web applications effortlessly. With Heroku, developers get support for a wide range of programming languages and frameworks. Heroku's simplicity and ease of use make it an attractive choice for startups and companies without dedicated DevOps teams.

Is Heroku HIPAA compliant? Yes, based on our research, Heroku can be HIPAA compliant.

 

What changed this year?

In February 2026, Salesforce, Heroku's parent company, announced that Heroku Shield, the enterprise compliance tier that supports HIPAA workloads, had moved to sustaining engineering.

 

Will Heroku sign a business associate agreement (BAA)?

Yes, Heroku will sign a business associate agreement, which can be requested by creating a support ticket with Heroku's sales team. Importantly, Heroku will only sign a BAA for customers using Heroku Shield under an Enterprise contract, standard Heroku, including its self-serve dynos and standard Postgres, is not HIPAA eligible and is not covered by any BAA.

 

What does the Heroku BAA cover?

The Heroku BAA covers the use and disclosure of protected health information (PHI) within Heroku Shield services, stating that Heroku helps customers "build engaging healthcare apps, fintech apps, or life sciences apps with secure data services and meet complex regulatory requirements, including HIPAA and PCI."

Heroku Shield includes:

  • Shield Private Spaces for network isolation and private routing
  • Shield Dynos, which run on dedicated compute with an encrypted ephemeral file system and restrict outdated TLS versions
  • Shield Postgres, which extends Heroku Postgres with enforced encryption in transit and at rest
  • Apache Kafka on Heroku Shield for encrypted, HIPAA-regulated event streaming
  • Heroku Connect for securely syncing PHI between Salesforce and Shield Postgres
  • Enhanced logging, including keystroke auditing for production SSH access in certain configurations

The BAA specifies exactly which Heroku services and add-ons fall within its scope, and each Shield-tier component must be used in place of its standard counterpart.

 

What does the Heroku BAA exclude?

Signing the BAA does not by itself make an application HIPAA compliant. It establishes the contractual relationship that makes Heroku a business associate, but compliance still depends on how the platform is configured and how the application itself handles PHI. Any add-on or third-party integration not explicitly listed as HIPAA-eligible in the BAA must be treated as out of scope for PHI, regardless of how the standard version of that same service functions elsewhere in the Heroku ecosystem.

 

Conclusion

Heroku signs a BAA and is, therefore, HIPAA compliant.

Learn more: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

 

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals' health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in fines and penalties for covered entities.

 

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.