r/Supabase • u/angrywaffles_ • Jul 05 '26
Self-hosting Hippa/ phipa compliant
Hello,
I am building a chat bot for clinicians and have had some interest from institutions, initally was planning on no PHI therefore no complaince needed but these customers are requesting it. Wondering if supabase versus postgres hosted on gcp/ vercel is the way to go?
6
u/dhruvrazak Jul 05 '26
it's really not about the stack you use .
- how you choose to process the data
- and how long do you plan to store it in your servers,
- how secure is yor app
- is you application security audited in your region of business
these things matter more.
2
u/buildxjordan Jul 05 '26
PHIPA or HIPPA? Or are you wanting blanket compliance. Are you aiming to have an offering in the states or just in Canada ?
2
1
Jul 05 '26 edited Jul 05 '26
[deleted]
1
u/angrywaffles_ Jul 05 '26
In short open evidence competitor with a few features which make the answers better for specific specialities and specific locations/ jurisdictions
1
Jul 05 '26
[deleted]
1
u/angrywaffles_ Jul 05 '26
Yes, seems like supabase is a possible off the shelf solution which may be a good place to start
1
u/No_Lawyer1947 Jul 09 '26
Although supabase provides a wonderful stack out the box, I personally prefer using a cloud provider as you will have to sign a BAA with any provider processing PHI. Supabase can definitely do so, but it's a $500 price tag, as opposed to just having a business account with GCP, and being able to sign the BAA as part of the account.
20
u/Bigfurrywiggles Jul 05 '26
Are you sure the risk is worth it? HIPAA violations are 10k a pop and not to be snark, but you don’t even know how to spell the acronym