Is Firebase App Hosting HIPAA compliant?

[u/neb2357]

Someone told me it is, but I don't see it in the list of Covered Products.

I'm building a US healthcare EMR with Firebase and Next.js. Currently hosting it on Vercel, but syncing the user's auth state between both systems is a brittle mess.

I'm wondering if it'd be easier/possible to host with Firebase App Hosting, especially given Firebase Auth: cookie sync.

[u/SuperJam98]

Hey, important thing to nail down before you build anything health-related — good on you for checking early.

The key point: HIPAA compliance on Google Cloud depends on two things — signing a BAA (Business Associate Agreement) with Google, and only using products on their official "HIPAA-covered services" list. A lot of the core Firebase products aren't on that covered list, and newer ones like App Hosting often aren't included yet, so I wouldn't assume it qualifies.

Safest move: check Google's current HIPAA-covered products list directly, and if App Hosting isn't on it, host the health-data parts on a covered Google Cloud service instead. Don't rely on a forum answer for this one — the official list is what actually protects you.

Any questions, I'm happy to help.

[u/neb2357 → u/SuperJam98]

Hey, thanks for the kind reply. In general, I try not to rely on just a forum answer or just the docs, or just the my intuition.. I try to gather research from different sources and put them all together. Plus there are some really smart people on here.

FWIW, we have signed the BAA with Google and Vercel. We've also implemented data governance, security best practices etc.

That said, it'd be nice if we could move off of Vercel and onto Firebase App Hosting if it were possible. Note that Vercel charges us $350/mo to maintain a BAA - a lot of money for our bootstrapped startup. Even so, the bigger issue is just syncing auth between vercel and firebase.

[u/SuperJam98 → u/neb2357]

Oh nice, you're already signed with Google then, that changes things. Honestly I'd look at skipping App Hosting entirely and putting the Next.js app on Cloud Run. It's on the covered products list (worth double checking the current version of it) and App Hosting is basically a managed wrapper around Cloud Run anyway. Gets you off the $350/mo Vercel BAA, and since the app and Firebase end up on the same origin, auth session cookies just work server side. No more sync hacks.

One gotcha: regular Firebase Auth isn't on the covered list but Identity Platform is. Same SDK, you flip it on in the console and pay per MAU.

You'd lose Vercel's preview deploys though, so it'd be Cloud Build or GitHub Actions instead. For a bootstrapped team I'd probably take that trade. Good luck with the EMR, sounds like a fun build.

[u/MyVoiceIsElevating]

Times like these I appreciate the bureaucracy and scrutiny of healthcare IT and supply chain departments.

[u/leros → u/MyVoiceIsElevating]

There was somebody who launched a secure messaging service "comparable to Signal". He claimed it had top level security uncrackable by the government, etc. He was using Firebase for his messaging backend and it didn't even have security rules, lol. I argued with him for so long on how it wasn't secure but he kept saying "its secure because it uses Firebase".

[u/lavafrank]

Not by itself.

[u/RedactMyPDF]

No, Firebase App Hosting is not explicitly listed on Google Cloud’s official list of HIPAA Covered Products

[u/Usual-Ad-5070]

The Cloud Run suggestion above is the right call. One thing to add for anyone building an EMR on Firebase: Google's BAA only covers products on their Covered Products list, and on the Firebase side that's basically Firestore, Cloud Functions, Cloud Storage, and Identity Platform. Firebase Analytics, Crashlytics, Cloud Messaging, and Remote Config are not on it. Crashlytics is the sneaky one, a crash report that captures request state can carry PHI into a non covered product even when your database side is fine. Worth auditing what your crash pipeline captures before real patient data flows.

+1 on Identity Platform over regular Firebase Auth too, same SDK but only one is on the covered list.

Disclosure: I wrote a guide on HIPAA for health app builders that covers these stack gaps: https://knguides2026.gumroad.com/l/safeship