HIPAA Compliant No-Code Tools: Who Actually Signs a BAA

Every comparison of HIPAA compliant no-code platforms I could find was written by a company that sells one of the platforms. The lists are real and some are useful, but the author is always on the list, and the author always wins.

I don’t sell a platform. I build custom systems, and I also build on Airtable and Softr when they fit, which means I have no reason to talk you into any of them. What follows is what each vendor states in its own documentation, linked so you can check it, plus what happened when I tried to get these agreements signed for real clients.

Where the platforms stand

Deliberately no prices here. Vendor pricing on this page moved twice in under three weeks while I was researching it, so every row links to the vendor’s live page in the section below instead of freezing a number that goes wrong.

What is a BAA, and why does it decide everything?

A Business Associate Agreement is the contract that makes it legal for a vendor to touch your patients’ data. If a platform stores, processes, or even passes through protected health information, HIPAA requires that contract before you put a single record in. Without it the use is a violation no matter how secure the product is. Encryption doesn’t substitute for it. Neither does SOC 2.

That is why “is this platform HIPAA compliant” is the wrong question. The question is whether they will sign, and on which plan.

Why won’t most no-code platforms sign a BAA?

Most of them won’t. That isn’t laziness, and it usually isn’t about the code. Signing means taking on legal liability for someone else’s patient data, and the obligations that come with it are a permanent operating cost:

• Annual risk assessments
• Penetration testing
• Security training for the whole team
• Incident response drills
• Documentation retention policies
• Someone whose job is compliance
• Cyber liability insurance

The architecture has to carry it too: audit logs, an isolated database rather than shared multi-tenant storage, and full request logging so that when something breaks it can be investigated instead of guessed at.

A platform priced at $19 a month per user cannot absorb that. So the ones that do sign either run a separate, more expensive product line for it, or restrict it to their enterprise tier. That single economic fact explains almost every result on this page.

Is Knack HIPAA compliant?

Yes, on its dedicated health plans, and it is one of only two platforms here with a real compliance product rather than an exception carved out of an enterprise tier.

Knack runs a separate HIPAA offering with a signed BAA, encrypted storage for protected health information, and audit logging. Current plans and terms are on Knack’s pricing page.

What you get is a capable builder for internal database applications, and it is strongest exactly where health care operations usually hurt: intake queues, case records, credential tracking, structured workflows your own team runs. Where it is weaker is the client-facing layer. You can build a portal on it, and it will look like a database application rather than a product. For an internal tool that is fine. For something you hand to patients under your own brand, it is a real compromise.

Is Caspio HIPAA compliant?

Yes, through its compliance edition, with a signed BAA and HIPAA-enabled hosting. Current terms are on Caspio’s pricing page.

Caspio is the most enterprise-shaped option on this page. It holds up under complex relational data and large record volumes, which is the thing most no-code tools quietly fail at once a real dataset arrives, and it has a long track record in health care and government. That history is worth something when you are the person signing off on where PHI lives.

The cost is the learning curve. Caspio expects you to think like someone building an application rather than someone assembling one, and teams arriving expecting a drag-and-drop afternoon tend to bounce off it. If you have someone technical, or you are paying someone technical, it repays the effort.

Both checked against the vendors’ own compliance and pricing pages, August 2026.

Is Airtable HIPAA compliant?

Conditionally, and more narrowly than the marketing suggests.

Airtable will sign. It is available on the Enterprise Scale plan, through a document called the Health Information Exhibit that contains the Business Associate Addendum. Current pricing sits on Airtable’s own pricing page, and their sales team handles the exhibit.

What almost nobody quotes is what the same document says you cannot do with it. From Airtable’s Health Information Datasheet:

“Do not use Airtable as a patient portal at this time.”

That is worth sitting with, because a patient or client portal is exactly what most people arrive wanting to build.

The datasheet adds three more boundaries. No ePHI in workspaces where Airtable AI is enabled, unless you have accepted the Airtable AI terms. (Which AI vendors will sign a BAA is its own question.) No ePHI in the body or subject line of automated email. And no ePHI in screenshots or support tickets when you contact Airtable.

Read together, these say something specific: the agreement covers Airtable as a database and work management system, not as the layer your clients log into, and not inside the automation features people reach for first. It is a real compliance path, for a narrower use case than it first appears. For everything that never touches PHI, Airtable remains excellent, and it is what most of our Airtable consulting work runs on.

Checked against Airtable’s Health Information Datasheet, August 2026. Airtable updates this document, so check the current version before relying on it.

Is Softr HIPAA compliant?

No, and this one is worth stating plainly because nothing on the first page of search results answers it.

Softr publishes no HIPAA compliance program and no BAA offering. Its pricing page lists SOC 2 report access, SSO, SCIM and IP whitelisting under security, with no HIPAA option on any plan. Even SOC 2 report access is gated to the enterprise tier.

I have asked Softr directly to sign a BAA for a client, and they declined.

SOC 2 is an independent audit of security controls. It is a genuine signal about how a company runs, and it is not HIPAA compliance. A platform can hold SOC 2 Type II and still be unusable for protected health information. None of that makes Softr a bad product. We build client portals on Softr regularly, for work that never touches PHI.

Is Bubble HIPAA compliant?

No. Bubble’s own documentation states that apps built on Bubble will not achieve HIPAA compliance, and that it does not sign BAAs on any plan, enterprise included.

The only pattern that works is using Bubble purely as a front end, with all protected health information held and processed somewhere else. That constrains the product hard, and it is easy to break the first time someone adds a field.

What breaks when you combine two no-code tools?

Most guides evaluate one platform at a time. Real builds almost never use one platform.

The common pattern is a front end from one vendor sitting on a database from another: a Softr or Bubble interface over an Airtable or Xano backend. It is fast, it looks good, and for anything unregulated it is often the right call.

Under HIPAA it creates a problem that no single vendor’s documentation addresses, because no vendor is describing someone else’s product.

Every party that touches the data needs to be covered. If protected health information passes through the front end, renders in it, or is cached by it, that vendor is handling PHI and needs its own signed agreement. A compliant database underneath does not make the interface on top compliant. One unsigned link breaks the chain, and the chain is what the regulation cares about.

That leaves three patterns people actually use.

Front end only, data held elsewhere. The interface never receives PHI. It displays non-identifying data and hands off to a compliant system for anything sensitive. This can work, and it is fragile in a specific way: the boundary lives in your team’s discipline rather than in the architecture.

A compliant component embedded in a non-compliant app. Vendors sell exactly this, usually as forms. Sensitive data is captured and stored in their environment and only non-PHI flows into the app. It is a real pattern. It moves the boundary rather than removing it, and you still have to know precisely where that boundary sits.

Everything on covered infrastructure. Slower to build, more expensive, and the only version where the answer to “which vendor is responsible” is simple. The stack-by-stack walkthrough lives in the HIPAA compliant portal guide.

This section exists because the question is asked constantly and answered almost nowhere. Search for whether a particular no-code stack can be made HIPAA compliant and what comes back is forum threads where practitioners ask each other and nobody knows.

When is no-code the right answer?

It would be easy to end this with “so build everything custom.” That isn’t true, and I say it as someone who sells custom builds.

If the work is internal, form driven and data heavy, and the interface needs to be clear rather than beautiful, the platforms that sign BAAs do the job well. Back office case management, intake queues, credential tracking, structured records your own team uses. Knack and Caspio both handle that, both sign, and both have real track records in healthcare. Caspio in particular holds up under complex data relationships and large volumes.

You give up design flexibility and you pay the compliance tier. In exchange you skip a build. For a lot of teams that trade is correct, and if that is your situation you should take it.

And when is it not?

Here is the pattern I see on almost every health care call. The client wants four things: a modern interface, something that ships quickly, external client portals, and room to scale. Add HIPAA and no no-code tool delivers all four.

You can have most of them by giving one up. Accept a plainer interface and Knack or Caspio will serve you well. Keep PHI out of the client-facing layer and Airtable works underneath. Drop the portal requirement and the field opens up considerably.

If you need all four together, the honest answer is that it gets built, on infrastructure you control, with a BAA chain you can actually trace. That costs more and it takes longer, and it is the only version where nobody has to hope a vendor’s policy doesn’t change. That is the work we do, and Affinity Care is what it looks like finished: caregiver onboarding cut from 21 days to 8, and compliance audit-ready every day.

Frequently asked questions

Which no-code platforms will sign a BAA?

As of August 2026: Knack, through its dedicated HIPAA plans. Caspio, through its compliance edition. Airtable, through the Health Information Exhibit on Enterprise Scale only. Softr, Noloco and Bubble offer no path. Current pricing for each is on the vendor’s own page.

Can I use a no-code front end with a HIPAA compliant backend?

Only if the front end never handles protected health information, and that is harder to guarantee than it sounds. If the interface displays, caches or proxies PHI, that vendor is handling it and needs its own agreement. A compliant database underneath does not extend coverage upward.

Does SOC 2 mean a platform is HIPAA compliant?

No. SOC 2 is an independent audit of security controls. HIPAA compliance is a legal relationship that requires a signed agreement between you and the vendor. A platform can hold SOC 2 Type II and still be unusable for protected health information, and several on this page are exactly that.

Is there a HIPAA certification for software?

No. The US Department of Health and Human Services does not certify or approve software. Any vendor claiming to be “HIPAA certified” is describing a third-party assessment, not a government approval. What matters is whether they will sign a BAA and what that agreement covers.