Hi, I’m building a healthcare application entirely on Backendless using Backendless database, Cloud Code/API services, authentication, and web hosting.
I’m considering adding the $399/month Enterprise Security Function Pack to my paid Backendless plan.
Can you please confirm:
Does the Enterprise Security Function Pack include a signed Business Associate Agreement (BAA)?
Does it provide the HIPAA-eligible/private hosting needed to store and process ePHI?
If I add it to my paid Scale plan, do I need any additional Managed Backendless, Dedicated, or other hosting plan for HIPAA use?
Does the BAA/coverage apply to all of the Backendless services my app would use, including:
Database
Cloud Code / API services
Authentication / user sessions
File and web hosting
Backups / restore
Are there any additional HIPAA-specific settings, configuration steps, or account requirements I would need before putting real PHI into the app?
Are there any extra HIPAA-related fees beyond my normal Backendless plan plus the $399/month Enterprise Security Function Pack?
Thank you for such detailed and clearly structured questions — they are exactly the right ones to ask for an application that will handle PHI.
Since they involve legal and contractual matters (the BAA, scope of coverage, and infrastructure), we want to make sure our answers are accurate and up to date, so we are currently reviewing them with the responsible team.
We will get back to you with answers shortly. If any of the questions would be better discussed directly, we will also suggest a convenient way to connect.
This email message, including any attachments or links contains confidential information, belonging to sender. This information is intended only for the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information after its stated need has been fulfilled.
If you are not the intended recipient, you are hereby notified that any use, disclosure, copying, distribution, or action taken in reliance on the contents of these documents is strictly prohibited. If you have received this email in error, please notify the sender immediately by reply email and destroy all copies of the original message and attachments.
* Does the Enterprise Security Function Pack include a signed Business Associate Agreement (BAA)?
Yes, it is available in Backendless Console when the pack is purchased.
* Does it provide the HIPAA-eligible/private hosting needed to store and process ePHI?
Yes, it provides HIPAA eligible storage for all your data.
* If I add it to my paid Scale plan, do I need any additional Managed Backendless, Dedicated, or other hosting plan for HIPAA use?
No, the Enterprise Security Pack runs on top of your Cloud plan.
Does the BAA/coverage apply to all of the Backendless services my app would use, including:
* Database
* Cloud Code / API services
* Authentication / user sessions
* File and web hosting
* Backups / restore
All of the above. Backup/restore is a standard process we run for all apps on the Scale plan.
* Are there any additional HIPAA-specific settings, configuration steps, or account requirements I would need before putting real PHI into the app?
You should inspect all security permissions in the app before opening up for production traffic. By default a Backendless app is configured to enable minimal friction between a developer and the system. As a result, the out of the box permission matrix has minimum protection and must be closed where it makes sense for your app.
* Are there any extra HIPAA-related fees beyond my normal Backendless plan plus the $399/month Enterprise Security Function Pack?
No.
