This document explains what the Health Insurance Portability and Accountability Act (HIPAA) is, how Supabase complies with it, and details the shared responsibility model between you and Supabase. It explains the importance of HIPAA, the respective roles of the customer and Supabase, and the differences from SOC 2 in an easy-to-understand manner, and provides guidelines for safely managing medical data.

1. What is HIPAA and why is it important? 🏥

HIPAA is an important law in the United States that focuses on protecting individuals' health information and ensuring continuity of health insurance. This law sets privacy and security standards that all organizations that handle Protected Health Information (PHI) or Electronic PHI (ePHI) must follow. Although HIPAA is a law that only applies to the United States, many other countries have similar laws or are in the process of enacting them.

Under HIPAA, both Covered Entities that directly handle medical information and Business Associates that assist them have clear responsibilities for protecting PHI. Here, Supabase acts as a business associate providing healthcare-related services for the customer, i.e. the responsible entity. To fulfill its obligations as a business associate, Supabase has been audited for its security and privacy controls, and has entered into Business Associate Agreements (BAA) with all vendors, such as AWS, that have access to ePHI to comply with their terms. Similarly, when a customer enters into a BAA with Supabase, the customer also has some responsibilities when using Supabase to store PHI.

2. Customer (responsible agency) responsibility 🧑‍💻

Customers who are Responsible Entities, such as hospitals, health insurers, and health care information processors, that directly process PHI have the following responsibilities:

1. HIPAA Compliance: Customer must protect the privacy and security of ePHI by complying with the HIPAA Privacy Rules, Security Rules, and Breach Notification Rules.
2. Signing a Business Associate Agreement (BAA): Customers must conclude a BAA with Supabase. When a responsible organization conducts medical activities with the help of a business associate, it must enter into a written BAA. This agreement sets out the business associate's responsibilities and requires compliance with HIPAA rules.
3. Internal Compliance Program: Customer must configure a HIPAA project and follow the guidance of the security advisor. Responsible organizations are responsible for implementing internal processes and compliance programs to meet HIPAA requirements.

3. Responsibilities of Supabase (Business Partnership Organization) 🤝

Supabase, as a business affiliate, and the vendors used by Supabase also have the following responsibilities as entities that perform specific functions or activities on behalf of customers.

1. Direct Responsibility: Supabase is directly responsible for compliance with certain provisions of the HIPAA Rules. This means that Supabase must implement safeguards to protect ePHI and report any breaches to customers.
2. Compliance with the terms of the BAA: Supabase must comply with the terms of the BAA, which includes implementing appropriate administrative, physical and technical safeguards to protect ePHI.
3. Vendor Management: Supabase must ensure that vendors with access to ePHI also comply with HIPAA rules. This is accomplished by signing a BAA with each vendor.

Compliance is not a one-time audit; it is an ongoing process. Supabase not only applies all necessary privacy and security controls for HIPAA compliance during audits, but also has additional checks and monitoring systems in place to ensure that these controls are not disabled or changed between audit periods. Customers must do the same in their own HIPAA environments. Supabase provides ongoing checks to alert you to changes that disable or weaken HIPAA-mandated controls in your projects. Customer will receive warnings and guidance from its security advisors, but Customer is directly responsible for applying the recommended controls.

You can learn more about HIPAA and general data management best practices, the division of responsibilities between customers and Supabase, and how to maintain compliance in the document Supabase's Shared Responsibility Model.

4. SOC 2 and HIPAA: What's the difference? 🧐

Although both are frameworks for protecting sensitive data, they differ in purpose and scope. Because they share many security and privacy controls, meeting one regulation often makes it easier to comply with the others.

• SOC 2: It is not limited to a specific industry and can be applied to all service organizations that handle customer data.
• HIPAA: A U.S. federal regulation that sets standards for the privacy and security of PHI/ePHI, ensuring patient data is handled confidentially and securely.

So, the answer to the question, "Is the Supabase HIPAA environment SOC 2 compliant?" is "Yes, it is!" Supabase applies the same SOC 2 controls to all environments, and applies additional controls to the HIPAA environment.

5. Frequently Asked Questions ❓

• Does Supabase log database connections by default? No, Supabase disables the log_connections setting in Postgres by default for new projects. However, projects that require HIPAA and high compliance should keep Connection Logging enabled. Security Advisor sends an alert when this setting is disabled.
• How often is Supabase audited? Supabase is audited annually. HIPAA controls are audited during the same audit period as SOC 2 controls.

Conclusion ✨

HIPAA compliance is essential to keeping healthcare data safe and secure, and Supabase shares this important responsibility with our customers. We have explained seemingly complicated regulations in an easy and friendly way, so now you can manage your medical data with confidence with Supabase! If you have any questions, please refer to the Supabase documentation or contact us at any time. 😊