{"id":13792,"date":"2022-10-10T06:00:55","date_gmt":"2022-10-10T13:00:55","guid":{"rendered":"https:\/\/www.couchbase.com\/blog\/?p=13792"},"modified":"2025-06-13T19:27:52","modified_gmt":"2025-06-14T02:27:52","slug":"build-hipaa-compliant-applications","status":"publish","type":"post","link":"https:\/\/www.couchbase.com\/blog\/build-hipaa-compliant-applications\/","title":{"rendered":"Build HIPAA Compliant Applications With Capella"},"content":{"rendered":"

Couchbase has successfully completed an independent review of HIPAA requirements.<\/strong><\/p>\n

For companies working in or with the healthcare industry, HIPAA compliant systems are a key part of your security architecture. Applications within those systems rely on databases to securely store, manage, transport, and protect data. In turn, those databases need to have technologies and controls in place that support an organization\u2019s security goals and operations.\u00a0<\/span><\/p>\n

Couchbase has partnered with organizations around the globe since 2011 to help them meet their data security needs. Not too long ago, Couchbase Capella<\/a>\u2122 completed a SOC 2 Type II audit and today we are excited to announce the continuing expansion of our security compliance efforts. Couchbase has successfully completed an independent review of Couchbase Capella for compliance with HIPAA requirements. Though customers are responsible for confirming their own HIPAA compliance, Capella is ready for use with our customers’ applications that must meet HIPAA requirements. To do so, customers will need to enter into a Business Associate Agreement (BAA) with Couchbase and put in place certain Capella security configurations. The Couchbase BAA covers all the key elements and topics required for such an agreement.\u00a0<\/span><\/p>\n

What are HIPAA and a BAA?<\/h2>\n

HIPAA stands for the Healthcare Insurance Portability and Accountability Act, and became law in the US in 1996. It is designed to safeguard protected health information (PHI), or individually identifiable health-related information, securely, in physical or electronic form.\u00a0<\/span><\/p>\n

Technology providers like Couchbase may be considered, under HIPAA rules, as business associates of an organization when providing services that involve the creation, receipt, maintenance, or transmission of PHI. When Couchbase operates as a business associate, the BAA is a contract between an organization and Couchbase that defines how Couchbase may use and discloses PHI and clarifies how Couchbase assists the organization in meeting the organization\u2019s obligations under HIPAA. For clarity, entering into a BAA with Couchbase is not sufficient to ensure an organization is HIPAA compliant: the organization must still confirm that its operations meet the requirements of HIPAA. Couchbase is just one part of an organization’s holistic security model and the BAA is designed to help support internal controls and HIPAA compliance.\u00a0<\/span><\/p>\n

Couchbase in the healthcare industry<\/h2>\n

Many of the world\u2019s leading healthcare organizations such as BD<\/a> and Maccabi<\/a> trust Couchbase on a daily basis to meet the performance and flexibility needs of their most important applications. <\/span>Couchbase helps customers to deliver cutting-edge technologies and experiences in areas like:<\/span><\/p>\n