Is GitHub Copilot HIPAA Compliant? What Microsoft’s Own BAA Excludes (2026)
No. GitHub Copilot is not HIPAA compliant, and — more strikingly — it’s explicitly excluded from Microsoft’s own HIPAA Business Associate Agreement (BAA), even though Microsoft owns GitHub. Microsoft offers a BAA covering Azure, Office 365, Dynamics 365, Microsoft 365 Copilot, and roughly two dozen other in-scope services. GitHub and GitHub Copilot are not on... Continue reading
Can You Store PHI in SaaS Tools? A HIPAA Framework for Healthcare Organizations
The short answer: Yes — but only if the vendor covers the exact product, plan, database, file storage, automations, integrations, and logging under a signed Business Associate Agreement (BAA), and only after you have verified every data path where PHI can travel. Most SaaS tools are not HIPAA compliant by default. A platform may look... Continue reading
Is DocuSign HIPAA Compliant?
Yes — DocuSign can be HIPAA compliant, but not on all plans. DocuSign lists HIPAA among its supported compliance frameworks and offers a Business Associate Agreement (BAA) on qualifying business plans. DocuSign holds SOC 2 Type 2, ISO 27001:2022, and PCI-DSS certifications — among the strongest security postures of any e-signature provider. However, free and... Continue reading
Is Lovable HIPAA Compliant? What Its Terms of Service Actually Say
Short answer: Lovable is not HIPAA compliant, and unlike most vibe-coding tools, its Terms of Service say so directly. As of the January 2026 update, Lovable’s ToS states in plain language: “You agree not to upload, input, or otherwise provide any protected health information under HIPAA, or any other sensitive categories of data… Our Services... Continue reading