HIPAA
For organizations in healthcare and related fields subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), MongoDB Cloud is HIPAA-ready and enables covered entities and their business associates to use a secure cloud database environment to process, maintain, and store protected health information (PHI).
View HIPAA compliance documentation in MongoDB’s Customer Trust Portal.
FAQ
HIPAA is United States legislation that provides data privacy and security provisions for safeguarding medical information. Specifically, HIPAA requires compliance with the following:
- Privacy Rule: National standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity.
- Security Rule: National standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those healthcare providers that conduct certain healthcare transactions electronically.
- Breach Notification Rule: Requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information.
HIPAA applies to organizations that are considered HIPAA-covered entities, including healthcare providers, health plans, and healthcare clearinghouses. However, most health care providers and health plans do not work in isolation and often use the services of a variety of other persons or businesses. HIPAA also requires covered entities that work with these HIPAA “business associates” to produce a contract that imposes specific safeguards on the PHI that the business associate uses or discloses.
Under the HIPAA regulations, database service providers such as MongoDB are considered business associates. The Business Associate Addendum (BAA) is a MongoDB contract that is required under HIPAA regulations to ensure that MongoDB appropriately safeguards PHI. The BAA also serves to clarify and limit the permissible uses and disclosures of PHI by MongoDB. Connect with our Sales team to request a BAA.
Yes. MongoDB has a standard BAA that we present to customers for signature. Please connect with our Sales team to begin the process.
The MongoDB BAA covers MongoDB Atlas, Atlas App Services, MongoDB Charts, Atlas Serverless, Cloud Manager, and MongoDB Atlas Data Lake. MongoDB BAA also covers Atlas for Government. Any products or features that are in beta, preview, or similar are not in scope.
It does not. The MongoDB BAA helps support your HIPAA compliance, but using MongoDB Cloud does not, on its own, achieve it. Your organization is responsible for ensuring that you have an adequate compliance program and appropriate internal processes in place that align with HIPAA requirements.
It is important to note that there is no certification recognized by the US Department of Health and Human Services (HHS) for HIPAA compliance and that complying with HIPAA is a shared responsibility between the customer and MongoDB. MongoDB Cloud can be used to build HIPAA compliant applications (within the scope of a BAA) but customers are ultimately responsible for evaluating their own HIPAA compliance.
Yes. MongoDB has undertaken an Independent Practitioner's Report assessing its compliance with requirements of the Health Insurance Portability and Accountability Act ("HIPAA") Security Standards for the Protection of Electronic Protected Health Information ("HIPAA Security Rule"), and the Notification in the Case of Breach of Unsecured Protected Health Information enacted as part of the American Recovery and Reinvestment Act of 2009 ("HITECH Breach Notification Requirements").
The report finds that MongoDB's description of its information security program "fairly presents the information security program supporting MongoDB Cloud Service Platform system that was provided to user entities, as of September 30, 2025", and "the information security program conformed to the applicable implementation specifications within the HIPAA Security Rule and the HITECH Breach Notification criteria, as described in Part 164 of CFR 45, as of September 30, 2025."
Schellman & Company, LLC performed the examination and authored the Independent Practitioner's Report on the Information Security Program for the MongoDB Cloud Service Platform System Related to HIPAA and HITECH.
Yes, a copy of the report is available to organizations that have completed an NDA with MongoDB. Existing customers can request documentation here. Prospective customers, please contact us.
