HIPAA is United States legislation that provides data privacy and security provisions for safeguarding medical information. Specifically, HIPAA requires compliance with the following:

•  Privacy Rule: National standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity.
•  Security Rule: National standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those healthcare providers that conduct certain healthcare transactions electronically.
•  Breach Notification Rule: Requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information.

Yes. MongoDB has undertaken an Independent Practitioner's Report assessing its compliance with requirements of the Health Insurance Portability and Accountability Act ("HIPAA") Security Standards for the Protection of Electronic Protected Health Information ("HIPAA Security Rule"), and the Notification in the Case of Breach of Unsecured Protected Health Information enacted as part of the American Recovery and Reinvestment Act of 2009 ("HITECH Breach Notification Requirements").

The report finds that MongoDB's description of its information security program "fairly presents the information security program supporting MongoDB Cloud that was provided to user entities, as of September 30, 2020", and "the information security program conformed to the applicable implementation specifications within the HIPAA Security Rule and the HITECH Breach Notification Requirements, as described in Part 164 of CFR 45, as of September 30, 2020."