HIPAA-compliant hosting

HIPAA-compliant hosting, with the BAA included

Apps you build with Panaceum publish to HIPAA-compliant hosting on AWS. Every app gets its own database, encryption keys, sign-in pool and audit trail, on shared hosting from $25 per app per month or in its own dedicated AWS account. One click-through Business Associate Agreement covers it.

See pricing

Early access. Panaceum is invite-only while we open up. You can build and preview HIPAA apps with synthetic data now; publishing with real patient data on HIPAA hosting under the BAA opens when plans launch, with no rebuild. Join the waitlist to request access.

Shared or dedicated, same safeguards

Compliance controls never vary by plan. Plans differ in capacity, isolation, staging and support.

  • Shared HIPAA hosting

    Hobby and Pro plans run each app in its own slot of a shared HIPAA environment: its own database and database roles, its own data and signing keys, its own functions and its own sign-in pool. No app can reach another app's data.

  • Dedicated AWS account

    The Dedicated plan gives the app its own production AWS account with its own database across two availability zones, a cross-Region backup copy and room for 25,000 users. Enterprise adds its own staging account and a disaster-recovery Region.

What HIPAA hosting includes

  • Business Associate Agreement

    A click-through BAA the workspace owner accepts before publishing, covering hosting, storage, backups and support access. Enterprise can negotiate its own.

  • Encryption

    TLS in transit; databases, files and backups encrypted at rest; each app's files and audit logs under the app's own key.

  • Audit trail

    Every access to health data logged per app and kept in write-once storage, so records can't be altered after the fact.

  • Backups

    Point-in-time recovery for 35 days. Deleting an app destroys its data and schedules its keys for deletion.

  • Staging before production

    Every release runs in staging with synthetic data first; the owner approves the move to production with MFA.

  • Network controls

    Apps can only call outbound hosts the owner approved, so patient data can't be sent anywhere unexpected.

HIPAA hosting questions

Hosting on infrastructure covered by a Business Associate Agreement, with encryption at rest and in transit, access controls, audit logs retained and protected from change, backups with point-in-time recovery, monitoring, and a documented breach process.

Yes, if each app's data is isolated and access is controlled and logged. On Panaceum's shared HIPAA hosting every app has its own database, its own roles, its own encryption keys and its own sign-in pool; nothing about an app's data is shared with another app.

Yes. Paid plans include a click-through Business Associate Agreement that the workspace owner accepts before publishing. Enterprise customers can negotiate their own terms.

Panaceum hosting is for apps built in Panaceum: the safeguards come from the platform runtime the app runs on.

What would you build first?

Panaceum is in early access. Join the waitlist and we’ll send you an access key.