HIPAA
For organizations in healthcare and related fields subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), MongoDB Cloud is HIPAA-ready and enables covered entities and their business associates to use a secure cloud database environment to process, maintain, and store protected health information (PHI).
View HIPAA compliance documentation in MongoDB’s Customer Trust Portal.
FAQ
HIPAA is United States legislation that provides data privacy and security provisions for safeguarding medical information. Specifically, HIPAA requires compliance with the following:
- Privacy Rule: National standards to protect individuals’ electronic personal health information that is created, received, used, or maintained by a covered entity.
- Security Rule: National standards to protect individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and those healthcare providers that conduct certain healthcare transactions electronically.
- Breach Notification Rule: Requires HIPAA covered entities and their business associates to provide notification following a breach of unsecured protected health information.
HIPAA applies to organizations that are considered HIPAA-covered entities, including healthcare providers, health plans, and healthcare clearinghouses. However, most health care providers and health plans do not work in isolation and often use the services of a variety of other persons or businesses. HIPAA also requires covered entities that work with these HIPAA “business associates” to produce a contract that imposes specific safeguards on the PHI that the business associate uses or discloses.
Under HIPAA, database service providers such as MongoDB may act as business associates. A Business Associate Agreement is a contract required under HIPAA that obligates MongoDB to implement appropriate safeguards for Protected Health Information (PHI) stored by our customers in Atlas. The BAA also serves to clarify and limit the permissible uses and disclosures of PHI by MongoDB.
Yes. If you use MongoDB Atlas through a self-service, pay-as-you-go account, a Business Associate Agreement (BAA) is included in the MongoDB Cloud Terms of Service. You do not need to request a separate BAA. Please note that if you already have signed a BAA with MongoDB, that BAA will continue to apply instead and the BAA in the MongoDB Cloud Terms of Service will not apply to your use of Atlas.
If your organization is billed by invoice under an Order Form, the BAA is not included automatically in the terms that apply to your use of MongoDB Atlas. Please contact your MongoDB account executive or our Sales team to request a BAA before storing or processing protected health information (PHI).
The MongoDB BAA covers MongoDB Atlas, Atlas App Services, MongoDB Charts, Atlas Serverless, Cloud Manager, and MongoDB Atlas Data Lake. MongoDB BAA also covers Atlas for Government. Any products or features that are in beta, preview, or similar are not in scope.
It does not. The MongoDB BAA helps support your HIPAA compliance, but using MongoDB Cloud does not, on its own, achieve it. Your organization is responsible for ensuring that you have an adequate compliance program and appropriate internal processes in place that align with HIPAA requirements.
It is important to note that there is no certification recognized by the US Department of Health and Human Services (HHS) for HIPAA compliance and that complying with HIPAA is a shared responsibility between the customer and MongoDB. MongoDB Cloud can be used to build HIPAA compliant applications (within the scope of a BAA) but customers are ultimately responsible for evaluating their own HIPAA compliance.
Yes. MongoDB has undertaken an Independent Practitioner's Report assessing its compliance with requirements of the Health Insurance Portability and Accountability Act ("HIPAA") Security Standards for the Protection of Electronic Protected Health Information ("HIPAA Security Rule"), and the Notification in the Case of Breach of Unsecured Protected Health Information enacted as part of the American Recovery and Reinvestment Act of 2009 ("HITECH Breach Notification Requirements").
The report finds that MongoDB's description of its information security program "fairly presents the information security program supporting MongoDB Cloud Service Platform system that was provided to user entities, as of September 30, 2025", and "the information security program conformed to the applicable implementation specifications within the HIPAA Security Rule and the HITECH Breach Notification criteria, as described in Part 164 of CFR 45, as of September 30, 2025."
Schellman & Company, LLC performed the examination and authored the Independent Practitioner's Report on the Information Security Program for the MongoDB Cloud Service Platform System Related to HIPAA and HITECH.
Yes, a copy of the report is available to organizations that have completed an NDA with MongoDB. Existing customers can request documentation here. Prospective customers, please contact us.
