# HIPAA BAAs are now available to Pro teams

**Published:** September 9, 2025 | **Authors:** Jen Chen, Jas Garcha, Shar Dara

---

Pro teams can now enter into a Business Associate Agreement (BAA) to support HIPAA-compliant workloads on Vercel. The BAA is available self-serve through the dashboard with no Enterprise contract required.

Vercel supports HIPAA compliance as a business associate by implementing technical and organizational safeguards, conducting annual audits, and offering breach notification in line with HIPAA requirements. Compliance is a shared responsibility between you and Vercel. Teams are responsible for configuring security features, managing access, and validating third-party services.

This update makes it easier for healthcare-focused applications to meet regulatory obligations without upgrading to Enterprise.

### Frequently asked questions:

**How can my organization enter into a BAA with Vercel?**

The HIPAA BAA is available via Vercel's all customers who are covered entities or business associates under HIPAA. Contact Vercel support to review BAA terms and ensure proper coverage.

The HIPAA BAA is available self service as a paid add on. You simply need to agree to the terms of the [Vercel Business Associate Agreement](https://vercel.com/legal/baa).

**Does having a BAA with Vercel ensure my organization's compliance with HIPAA?**

No. By offering a BAA, Vercel helps support your HIPAA compliance, but using Vercel doesn't automatically ensure compliance. Your organization is responsible for ensuring adequate compliance programs, internal processes, and that your use of Vercel aligns with HIPAA requirements.

**I have a healthcare SaaS solution deployed on Vercel. Do my customers need to sign a BAA with Vercel?**

No. If you're a SaaS provider with a healthcare solution on Vercel, your customers can sign a BAA directly with you. They don't need a separate BAA with Vercel unless they also directly use Vercel services independently.

**Can Vercel be considered a "conduit" rather than a business associate?**

Generally, no. Vercel's services typically involve creating, receiving, maintaining, or transmitting PHI, which qualifies Vercel as a business associate. The conduit exception is very limited and applies only to pure transmission services with temporary storage incident to transmission.

**What happens if Vercel experiences a security incident involving my PHI?**

Vercel will report security incidents according to BAA terms and will provide breach notification if required by HIPAA. The response depends on the nature of the incident and whether it constitutes a breach of unsecured PHI.

**Can I use Vercel's services if my data is stored internationally?**

Yes, HIPAA permits international data storage with proper BAAs and safeguards. However, you must conduct a risk assessment considering geographic and geopolitical risks and implement appropriate additional safeguards if needed.

**Are modifications accepted to the Vercel HIPAA BAA agreement possible?**

No. You must be on an Enterprise plan for any redlines to the standard agreement.

Read more about other [updates to Pro](https://vercel.com/blog/new-pro-pricing-plan) and [switch to the new Pro pricing](https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fsettings%2Fbilling&title=Switch+to+new+Pro+pricing).

**A more flexible Pro plan.**
Start building with the new Pro plan today. Flexible credits, free viewer seats, and enterprise-grade features now available.
[Read more](https://vercel.com/blog/new-pro-pricing-plan)

---

📚 **More updates:** [View all changelog entries](/changelog/sitemap.md) | [Blog](/blog/sitemap.md)