Menu
I want to use Firebase Cloud Messaging in a healthcare application. I want to know is FCM HIPAA Compliant and does it provide BAA?
510
Other Firebase products are not part of GCP's business associate agreement, are unsuitable for handling protected health information, and are not HIPAA-compliant. Back4App is a reliable Firebase HIPAA alternative and can sign BAAs with customers looking to store PHI data under their dedicated resources plans.
So Cloud Firestore is covered under HIPAA compliance and Firebase Realtime Database is not covered.
Sync.com is the best HIPAA-compliant cloud service, offering a triple threat of zero-knowledge encryption, access control and a low price point. Google Drive, OneDrive and Dropbox all technically offer HIPAA compliance, though their history of mishandling user data means you'd be wise to stay away from them.
Firebase is certified under major privacy and security standards.
We’ve just completed the HIPAA audit with a 3rd party for a Firestore Chat sample app (iOS and Android) that’s using End-to-End Encryption. If you’re implementing a healthcare Chat app, keep reading. Otherwise, this isn’t relevant.
The challenge: if you know how E2EE works, you realize that it alone should protect your patients’ data from Firebase/Firestore: apparently, lawyers don’t agree with that. So we had to implement an artificial data redaction that deletes chat messages from Firestore as soon as the messages are delivered. This enables your app to qualify for HIPAA’s Conduit exception, because it only acts as a message delivery system, it doesn’t store permanent health data. This way, your chat solution is exempt of HIPAA.
We’ve compiled the solution into a How-to blog post: https://VirgilSecurity.com/hipaa-firebase - with pointers to reusable sample apps.
Whitepaper that contains our HIPAA audit & 3rd-party data privacy expert’s notes: https://VirgilSecurity.com/firebase-whitepaper
50
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
