How to make your Base44 app HIPAA compliant

Lucy wrote to me in March. She's a therapeutic consultant, and her son had built her an app on Base44 that she liked a lot. She works with families in treatment, so before she could use the app with real clients it had to be HIPAA compliant. What she had been offered, by everyone she asked, was to build the app again from scratch: estimates from $3,000 to $60,000 “to do the work to migrate it and maybe fix a few things”, and then at least $700 a month to host it “in a HIPAA compliant manner”.

I get an email like Lucy's every week now, from counseling offices, clinics, labs, care homes. Someone built an app for their practice, it works, and right when real patients are about to go into it they find out that Base44 doesn't do HIPAA. And what they're offered, like Lucy, is to build the app again somewhere else.

Base44 doesn't sign a BAA, on any plan

HIPAA has one rule that decides where your app can run. Every company that stores or handles patient information for you has to sign a Business Associate Agreement with you, a BAA. In it, the company takes responsibility for protecting that data under HIPAA. This includes the company that runs your app on its servers. It applies even when the data is encrypted and the company can't read it. Without a BAA, patient information can't be on their servers.

Base44 doesn't sign a BAA, and has no HIPAA plan. Not on the free plan, not on Elite, not on Enterprise. Their terms say that protected health information must not be put on the platform at all. Base44's security certifications (SOC 2 and ISO 27001) are about security; they aren't HIPAA. People have been asking Base44 for a BAA on their feedback board since April 2025. All requests have gone unanswered, and it's nowhere on their roadmap.

So an app that runs on Base44 can't hold patient information. This has nothing to do with how your app is built. It's about who runs the servers, and on Base44 that's Base44. That is why everyone Lucy asked offered to build her app again somewhere else.

What HIPAA requires of each part of your app

Your app has a few parts, and it helps to see them separately. There is the frontend: the screens people use. There is the database that holds the records. There are the files people upload. And there is the backend: the functions that run the app's logic, the emails it sends, the AI features, the logins. On Base44, every one of these runs on Base44's servers.

HIPAA requires that every part which handles patient information sits with a company that has signed a BAA with you. Not just the database. A function that reads a patient's record, an email that mentions an appointment, an AI feature that summarizes a note, a file with a scan in it: each of these handles patient information, and each one needs to be on a covered service.

The workarounds that keep the app on Base44 aren't HIPAA compliant

At this point, many naturally look for workarounds that keep them on Base44 while also getting HIPAA set up right. The truth is that such workarounds are not HIPAA-compliant. Even some popular Base44 “HIPAA solutions” are not, in fact, HIPAA-compliant. Here are the most common ones:

1. Asking the builder to “make the app HIPAA compliant”. A BAA is a contract with the company that holds your data, and no code changes which company that is. When the builder is done, the app runs on Base44's servers exactly as before, with the same records in it.
2. Taking the names out of the records. HIPAA treats every date except the year as an identifier, and so are an email address, a phone number and a photo. A record with an appointment date in it is patient information, with or without the name on it.

3. Keeping the app on Base44 and moving just the patient data to a HIPAA database. This is Base44's own suggestion, and it sounds right: the patient data is the problem, so put the patient data somewhere HIPAA and leave the rest where it is.

   The problem is that your app is still on Base44. If your patients log in, they log in through Base44, so your patient list sits on Base44's servers. Base44 also logs every login and every page each user opens, under their email address, and by its own docs those logs can't be deleted. If your staff use the app, Base44 gets the record number of every patient file they open. And everything the app does with a record runs on Base44, with the patient's data passing through, even when the record comes from a HIPAA database: the functions, the emails, the uploads, the AI, the automations, the connectors, anything a Base44 app does. All of it is patient information on Base44's servers, and since Base44 doesn't sign a BAA, that's a HIPAA violation.

   So wherever the patient data goes, an app that stays on Base44 isn't HIPAA compliant. That holds however the data is moved, by Base44's own AI or by a service that provides the HIPAA database (like Knack Health).

   Moving only the intake forms to a HIPAA form service (like HIPAAtizer) has the same problem. The form itself is compliant: what a patient fills in goes straight to the form service, not to Base44. But only the form. The moment your app does anything with what the patient filled in, shows it to your staff, emails it, saves it, that's patient data on Base44's servers and therefore a HIPAA violation. So is anything else in the app that's tied to a patient, however small: their login, the date of their next visit, even a reminder email that just says “see you Tuesday”.

All these workarounds fail for the same reason: they keep the app on Base44, and a HIPAA app can't run on a non-HIPAA platform. There is no workaround for that. Nowhere else does this problem even come up.

How HIPAA apps normally run

Outside Base44, a BAA is not a special arrangement. The normal cloud providers, AWS and Google Cloud, the ones hospitals and health apps run on, sign a BAA with any customer. You accept it inside your own account, in a few clicks, and it costs nothing extra. From then on, you are covered.

But that’s how it works for normal apps. The question is how to get there with a Base44 app.

One way is to build it again. This is what Lucy was offered by a development agency. And it works: every part of the new app is covered and nothing is left on Base44. But it's weeks of work and a full development project, at the prices Lucy was quoted, just to end up with the app you already have.

The other way is to move the app, exactly as it is, onto one of these providers. Nobody offered it to Lucy because getting an app out of Base44 is extremely hard: Base44's export gives only a small part of the app, not the backend, the configs, or the data the app runs on.

This is why I built EscapeBase44. I got stuck on Base44 with an app of my own, spent months reverse-engineering their entire backend until I could get my app out, and then automated the whole process. EscapeBase44 takes the app you already built on Base44 and moves all of it, exactly as it is, onto a normal provider under your own account. Every screen, every record, every uploaded file, the backend functions, the users and their passwords, everything. Nothing is built again.

How the move makes your app HIPAA compliant

There’s a HIPAA switch during setup. With it on, the whole app lands on your own AWS or Google Cloud account, and nothing stays on Base44 or passes through EscapeBase44. There, every part of the app runs under a BAA: the screens, the records, the files, the functions and the emails run under AWS’s or Google’s BAA, and the AI runs under OpenAI's BAA. So every feature can work with patient information. You're walked through opening the account and accepting each BAA, click by click. Then, that's it: your app is HIPAA compliant.

At this point many ask me: but how do I keep building, can I keep using Base44? The good news is you don't need to. EscapeBase44 comes with its own AI builder, exactly like Base44’s. Except that this one is fully HIPAA safe: it builds on a copy of your app with no patient records in it, so nothing you do while building ever touches your patients' data. You can also keep building any other way you want: you now own the app, and it runs on your own accounts.

The move is priced to your app and is fully automatic: it usually takes a few minutes. You can log in to instantly see your price. You pay once and after that the only recurring bill is the provider's, around $20 a month for most apps, paid to them directly. You’ll see all provider costs and details during setup. There is no Base44 subscription anymore, and no EscapeBase44 subscription either.

Since Lucy, over 20 healthcare professionals have migrated their Base44 apps through EscapeBase44 and made them HIPAA-compliant. Michael wrote me this right after his move:

“Daniel you are the man! What service! The migration seems to have worked great; I was so impressed with what you have built. That's truly incredible to have reverse engineered all of that so well. It's a whole new world now. Amazing product.”

Thomas runs a foster care and therapy agency, and his staff of 14 now works in the migrated app (“Awesome, thank you so much!”). Nancy, a psychologist in Denver, migrated the screen-time app she built for her clients (“I'm all set up now. Thanks for a great product”). And Lowell moved his app for licensed clinicians over (“Everything is up and running. Thank you sir!”). They all keep building on the HIPAA-safe AI builder just like they did on Base44. But now with peace of mind, knowing they're perfectly HIPAA-compliant.

Base44 HIPAA FAQ

• Is Base44 HIPAA compliant?

  No. Base44 doesn't sign a Business Associate Agreement on any plan, Enterprise included, and its terms say that protected health information isn't to be put on the platform. Its SOC 2 and ISO 27001 certifications are about security; they aren't HIPAA.

• Does Base44 sign a BAA?

  No, not on any plan. People have been asking for one on Base44's feedback board since April 2025, and the requests have gone unanswered.

• Can I store patient data in Base44 if it's encrypted?

  No. Under HIPAA, a company that stores patient information needs a BAA even when the data is encrypted and it can't read it, and Base44 doesn't sign one.

• Can I keep my app on Base44 and put the patient data in a HIPAA database?

  No. The app is still on Base44: your patients log in through Base44, Base44 logs every login and page each user opens under their email, and everything the app does with a record (the functions, emails, uploads, AI, automations, connectors) runs on Base44.

• Does my app even fall under HIPAA?

  If it holds patients' health information for a US practice, clinic, lab or other healthcare provider, or does work for one, yes. A wellness app with no healthcare provider behind it usually doesn't.

• How do I make my Base44 app HIPAA compliant?

  Move it, as it is, onto a normal provider that signs a BAA, in your own account. EscapeBase44 does that move for you with its HIPAA switch and walks you through accepting the agreements; nothing gets rebuilt.

• Who signs the BAA after the move?

  You do, in your own account on the provider's site, a few clicks you're walked through after the migration. If the app uses Base44's built-in AI, it runs on your own OpenAI key and OpenAI signs a BAA too.

• Do I need a BAA with EscapeBase44?

  No. The move runs once, nothing in the running app goes through EscapeBase44, and it keeps no copy of your data. After the move, only you and the providers you signed with can reach it.

• Can I keep editing my app after it moves?

  Yes, through an AI chat like Base44's, and you never go back to Base44 or migrate again. The builder works on a copy of your app with no patient records in it, so editing never touches the real data.

• What does it cost per month after the move?

  Only the provider's bill, paid to them directly: around $20 a month for the server for most apps. There's no Base44 plan anymore and nothing recurring to EscapeBase44.

• Do my users and records come along?

  Yes. Every record, file and user account moves, your users keep their passwords, and your Base44 app stays untouched while the move runs.