aws.amazon.com/amplify

Yes. The list is shorter than you might expect, because **“HIPAA-ready” and “will sign a BAA” are not the same thing**. If a platform creates, receives, maintains, or transmits ePHI on your behalf, HHS says you generally need a BAA with that provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ### No-code / low-code platforms that can support a BAA | Platform | BAA? | Important caveat | |---|---|---| | **[Airtable](https://www.airtable.com?utm_source=chatgpt.com)** | **Yes** | HIPAA is currently limited to **Enterprise Scale**; you execute Airtable's Health Information Exhibit/BAA. [www.airtable.com](https://www.airtable.com/company/hipaa-airtable?utm_source=chatgpt.com) | | **[Superblocks](https://www.superblocks.com?utm_source=chatgpt.com)** | **Yes** | Explicitly says it will sign a BAA with HIPAA-covered customers. More low-code than pure no-code. [docs.superblocks.com](https://docs.superblocks.com/enterprise/security/hipaa?utm_source=chatgpt.com) | | **[WeWeb](https://www.weweb.io?utm_source=chatgpt.com)** | **Potentially / architecture-dependent** | Particularly attractive if you keep PHI in your own HIPAA-eligible backend and use WeWeb as the frontend. It supports self-hosting/export and emphasizes keeping data on your infrastructure. [www.weweb.io](https://www.weweb.io/blog/hipaa-compliant-app-builder-choosing-guide?utm_source=chatgpt.com) | | **[AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) + AWS** | **Yes, at AWS level** | AWS has a BAA and lists Amplify among HIPAA-eligible services. You still have to configure the architecture correctly. [aws.amazon.com](https://aws.amazon.com/tr/compliance/hipaa-eligible-services-reference/?utm_source=chatgpt.com) | | **[Mendix](https://www.mendix.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Enterprise low-code platform with HIPAA support; substantially heavier than typical startup no-code tools. | | **[ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Strong choice if you're already in ServiceNow; expensive/overkill for most small projects. [www.superblocks.com](https://www.superblocks.com/blog/ai-governance-features-low-code-app-platforms?utm_source=chatgpt.com) | ### Platforms I'd *not* assume are BAA-capable **Bubble:** despite being popular for healthcare apps, Bubble currently says its platform and internal processes **do not meet HIPAA requirements and it does not support HIPAA-compliant apps**. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Framer:** explicitly says it isn't designed for HIPAA and shouldn't be used to process or store PHI. [www.framer.com](https://www.framer.com/help/articles/framer-hipaa-compliance/?utm_source=chatgpt.com) ### My shortlist If you're trying to build an actual **HIPAA-regulated application without traditional coding**, I'd narrow it to: 1. **Airtable** — easiest if your application is essentially a database/workflow/portal. 2. **Superblocks** — strongest if you're building internal healthcare tools, dashboards, CRUD apps, or operational software. 3. **WeWeb + HIPAA-eligible backend** — probably the most interesting option for a polished customer/patient-facing web application. 4. **AWS + a no-code frontend** — best if you want maximum control and are willing to have a more technical architecture. One important distinction: **getting a BAA does not make your application HIPAA compliant by itself.** Your authentication, authorization, audit logging, integrations, backups, data flows, breach procedures, workforce policies, and overall risk analysis still matter. HHS specifically notes that compliance is a shared responsibility and that customers need to understand and configure their cloud environment appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, intake form, clinician dashboard, scheduling app, internal CRM, AI app), I can narrow this to the **3 best no-code stacks that will actually work for that use case**, including approximate pricing and whether the BAA is available on a normal plan or only enterprise. [Airtable](https://www.airtable.com?utm_source=chatgpt.com) [Superblocks](https://www.superblocks.com?utm_source=chatgpt.com) [WeWeb](https://www.weweb.io?utm_source=chatgpt.com) [AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) [Mendix](https://www.mendix.com?utm_source=chatgpt.com) [ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com) | Platform | BAA? | Important caveat | |---|---|---| | **[Airtable](https://www.airtable.com?utm_source=chatgpt.com)** | **Yes** | HIPAA is currently limited to **Enterprise Scale**; you execute Airtable's Health Information Exhibit/BAA. [www.airtable.com](https://www.airtable.com/company/hipaa-airtable?utm_source=chatgpt.com) | | **[Superblocks](https://www.superblocks.com?utm_source=chatgpt.com)** | **Yes** | Explicitly says it will sign a BAA with HIPAA-covered customers. More low-code than pure no-code. [docs.superblocks.com](https://docs.superblocks.com/enterprise/security/hipaa?utm_source=chatgpt.com) | | **[WeWeb](https://www.weweb.io?utm_source=chatgpt.com)** | **Potentially / architecture-dependent** | Particularly attractive if you keep PHI in your own HIPAA-eligible backend and use WeWeb as the frontend. It supports self-hosting/export and emphasizes keeping data on your infrastructure. [www.weweb.io](https://www.weweb.io/blog/hipaa-compliant-app-builder-choosing-guide?utm_source=chatgpt.com) | | **[AWS Amplify](https://aws.amazon.com/amplify?utm_source=chatgpt.com) + AWS** | **Yes, at AWS level** | AWS has a BAA and lists Amplify among HIPAA-eligible services. You still have to configure the architecture correctly. [aws.amazon.com](https://aws.amazon.com/tr/compliance/hipaa-eligible-services-reference/?utm_source=chatgpt.com) | | **[Mendix](https://www.mendix.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Enterprise low-code platform with HIPAA support; substantially heavier than typical startup no-code tools. | | **[ServiceNow App Engine](https://www.servicenow.com?utm_source=chatgpt.com)** | **Yes / enterprise** | Strong choice if you're already in ServiceNow; expensive/overkill for most small projects. [www.superblocks.com](https://www.superblocks.com/blog/ai-governance-features-low-code-app-platforms?utm_source=chatgpt.com) | ### Platforms I'd *not* assume are BAA-capable **Bubble:** despite being popular for healthcare apps, Bubble currently says its platform and internal processes **do not meet HIPAA requirements and it does not support HIPAA-compliant apps**. [manual.bubble.io](https://manual.bubble.io/help-guides/infrastructure/compliance/hipaa?utm_source=chatgpt.com) **Framer:** explicitly says it isn't designed for HIPAA and shouldn't be used to process or store PHI. [www.framer.com](https://www.framer.com/help/articles/framer-hipaa-compliance/?utm_source=chatgpt.com) ### My shortlist If you're trying to build an actual **HIPAA-regulated application without traditional coding**, I'd narrow it to: 1. **Airtable** — easiest if your application is essentially a database/workflow/portal. 2. **Superblocks** — strongest if you're building internal healthcare tools, dashboards, CRUD apps, or operational software. 3. **WeWeb + HIPAA-eligible backend** — probably the most interesting option for a polished customer/patient-facing web application. 4. **AWS + a no-code frontend** — best if you want maximum control and are willing to have a more technical architecture. One important distinction: **getting a BAA does not make your application HIPAA compliant by itself.** Your authentication, authorization, audit logging, integrations, backups, data flows, breach procedures, workforce policies, and overall risk analysis still matter. HHS specifically notes that compliance is a shared responsibility and that customers need to understand and configure their cloud environment appropriately. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) If you tell me **what you're trying to build** (e.g. patient portal, intake form, clinician dashboard, scheduling app, internal CRM, AI app), I can narrow this to the **3 best no-code stacks that will actually work for that use case**, including approximate pricing and whether the BAA is available on a normal plan or only enterprise.