# HIPAA Compliance and BAA **URL:** \ **Category:** Deployments\ **Tags:** security\ **Created:** [March 25, 2026, 5:26pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497 "2026-03-25T17:26:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![markgagern](https://avatars.discourse-cdn.com/v4/letter/m/ea5d25/32.png) [@markgagern](https://replit.discourse.group/u/markgagern)\ **Post date:** [March 25, 2026, 5:26pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497/1 "2026-03-25T17:26:31Z")
I love using replit for designing and building applications. I was just using Replit to generate examples and prototypes for my Dev team. I now realize that for some scenarios the applications I have developed could be used in a production role with clients. Unfortunately, since we do not have a BAA signed with Replit I need to always use de identified data to build applications. Then I need to submit the application to my team to deploy it in our secure Azure environment. Two questions, 1 will Replit sign a HIPAA BAA and 2. is there an easier way to deploy applications to Azure. The process is complicated enough that I need my DevOps team to do it. Thanks! ---
**Author:** ![mikeamancuso](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/mikeamancuso/32/3507_2.png) [@mikeamancuso](https://replit.discourse.group/u/mikeamancuso)\ **Post date:** [March 25, 2026, 7:01pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497/2 "2026-03-25T19:01:31Z")
I work in healthcare with Replit. NEVER put PHI in Replit. Use GitHub actions to setup a CI/DI pipeline that pushes to azure. You can give Replit your API keys for both and it will set them up. > This is one of my CI/CD pipelines for healthcare: > > ![image](https://canada1.discourse-cdn.com/flex010/uploads/replit/original/2X/4/40b378331e863c6dfff2ec9f275138c5c596320c.png) Let me know if you have questions on the topic. ---
**Author:** ![realfunnyeric](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/realfunnyeric/32/2150_2.png) [@realfunnyeric](https://replit.discourse.group/u/realfunnyeric)\ **Post date:** [March 25, 2026, 7:46pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497/4 "2026-03-25T19:46:45Z")
What type of biz is it? ---
**Author:** ![mikeamancuso](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/mikeamancuso/32/3507_2.png) [@mikeamancuso](https://replit.discourse.group/u/mikeamancuso)\ **Post date:** [March 25, 2026, 9:39pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497/5 "2026-03-25T21:39:09Z")
What would be helpful for me to cover? On this project, I have 4 separate actions: 1. **ci-test** — Runs automatically on every push. Handles the fast feedback loop: type checking, linting, dependency audit, 16-shard tests with coverage, build, and integration tests. No analysis or deploy. 2. **ci-full** — Manual trigger only. Runs everything from ci-test plus CodeQL security analysis and SonarCloud code quality scan. 3. **ci-deploy** — Manual trigger only. Runs everything from ci-full, and if all checks pass, deploys to ECS. 4. **ci-deploy-only** — Manual trigger only. A troubleshooting escape hatch that skips all tests and analysis, and just builds and deploys to ECS. Action 1 is taken every time Replit makes a commit. It is way faster to run my tests in CI than in Replit. (I have thousands of tests.) ---
**Author:** ![mikeamancuso](https://yyz2.discourse-cdn.com/flex010/user_avatar/replit.discourse.group/mikeamancuso/32/3507_2.png) [@mikeamancuso](https://replit.discourse.group/u/mikeamancuso)\ **Post date:** [March 26, 2026, 10:55pm UTC](https://replit.discourse.group/t/hipaa-compliance-and-baa/10497/7 "2026-03-26T22:55:24Z")
I am not sure what to post, but I am happy to hop on a call for a quick virtual coffee and answer any questions you might have. You can grab a virtual coffee by visiting [https://mancuso.ai](https://mancuso.ai).