mirror of
https://github.com/supabase/supabase.git
synced 2026-10-11 04:15:04 +03:00
CharisandChris Chinchilla
47705a8968
* fix: rewrite relative URLs when syncing to GitHub discussion Relative URLs back to supabse.com won't work in GitHub discussions, so rewrite them back to absolute URLs starting with https://supabase.com * fix: replace all supabase urls with relative urls * chore: add linting for relative urls * chore: bump linter version * Prettier --------- Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
29 lines
1.8 KiB
Plaintext
29 lines
1.8 KiB
Plaintext
---
|
|
id: 'hipaa'
|
|
title: 'HIPAA Projects'
|
|
description: 'Projects that store or process Protected Health Information (PHI) and other sensitive data'
|
|
---
|
|
|
|
You can use Supabase to store and process Protected Health Information (PHI). If you want to start developing healthcare apps on Supabase, reach out to the Supabase team [here](https://forms.supabase.com/hipaa2) to sign the Business Associate Agreement (BAA).
|
|
|
|
<Admonition type="note">
|
|
|
|
Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI.
|
|
|
|
</Admonition>
|
|
|
|
## Configuring a HIPAA project
|
|
|
|
When the HIPAA add-on is enabled on an organization, projects within the organization can be configured as _High Compliance_. This configuration can be found in the [General Project Settings page](/dashboard/project/_/settings) of the dashboard.
|
|
Once enabled, additional security checks will be run against the project to ensure the deployed configuration is compliant. These checks are performed on a continual basis and security warnings will appear in the [Security Advisor](/dashboard/project/_/advisors/security) if a non-compliant setting is detected.
|
|
|
|
The required project configuration is outlined in the [shared responsibility model](/docs/guides/deployment/shared-responsibility-model#managing-healthcare-data) for managing healthcare data.
|
|
|
|
These include:
|
|
|
|
- Enabling [Point in Time Recovery](/docs/guides/platform/backups#point-in-time-recovery) which requires at least a [small compute add-on](/docs/guides/platform/compute-add-ons).
|
|
- Turning on [SSL Enforcement](/docs/guides/platform/ssl-enforcement).
|
|
- Enabling [Network Restrictions](/docs/guides/platform/network-restrictions).
|
|
|
|
Additional security checks and controls will be added as the security advisor is extended and additional security controls are made available.
|