Not a Hippa expert but I believe that the focus is on encrypted data transmisión and Hippa compliant storage. While Bubble storage may not be compliant you are able to build on Bubble and store with a 3rd party that is compliant as long as you encrypt the transfer of data.
Your vision could be achived using Firebase Firestore, it’s HIPAA complient and using the Data Layer plugin writing to your database avoids Bubble logs as it uses the Firebase JavaScript Client SDK so no server side log or usage. Just a thought.
@PWC That is an interesting thought. However, it still makes me wonder about the need for a BAA from Bubble. At the same time, apps that are HIPAA compliant that use services like Stripe, they don’t require Stripe to sign a BAA. Since we wouldn’t be saving logs on Bubble, I wonder if that makes us like Stripe. I believe Firebase will sign that BAA.
Do you have any examples of this, or is it merely a thought?
By extention, Google will providing your product selection from them is in this list,
Covered Products
The Google Cloud BAA covers GCP’s entire infrastructure (all regions, all zones, all network paths, all points of presence), and the following products:
@PWC Yes, I do understand that Google Cloud BAA covers GCP’s entire infrastructure. However, those are all Google’s components. The mear fact that we are using Bubble, does that present a problem with HIPAA compliance even though we would be storing logs on firebase firestore?
I mean, it seems obvious to me that it would be in compliance, but I am just trying to find a resounding YES from someone.
If you use the Firebase Client JavaScript SDK to auth your user, then read write using the Client JavaScript SDK to the Cloud Firestore, Then as far as I am concerned you have used Google’s product for the complete solution making the data transacted within (as long as you use the data as a state in Bubble) compliant.
Using this method you can also write native Java apk’s later for the app store, or node, python or what ever your flavour later should your app scale outside of the bubble sphere or should you decide to allow external entities to build from your data enviroment.
This was why I made the Data Layer plugin include sign in/out not just read write.
@PWC I actually purchased the plugin and it really seems amazing add on to speed up things and bring more options especially if you are thinking about the future and where data is being stored location wise.
What I would like to see is editor view about how to actually use it with repeating groups to filter records etc… And basic examples about rules on firestore side. For example if ”current users list X contains Y then user can access to that info. How does the username and password access needs to work in sync with bubble?
Making this users favourite number the value of that input.
Your Firestore rules would reflect something like this,
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{uid} {
allow read, write: if request.auth.uid == uid;
}
}
}
Because the user is signed in using the SDK and has the UID that your using as the data path your pushing a field or JSON to the data will write and can be read by that user also.
You can get fancy with your rules or keep them neat, they are granular and can be very flexible.
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
//Example of wide open read only data path no auth - remove this comment!
match /public/assets {
allow read: if true;
}
//Example of anyone thats authed can read data path - remove this comment!
match /everyone/stuff {
allow read: if request.auth.uid != null;
}
//Example of only user matching current users UID can read/write - remove this comment!
match /users/{uid} {
allow read, write: if request.auth.uid == uid;
}
}
}
This is good info! It takes time to set things up but I will get there. Some kind of tutorial would be helpful for sure especially from security point of view.
How about set up for this kind of Rule
Bubble user has a list of of company’s
A, B and C
Under each company there are contacts with a company field
How can I restrict users with a rule accessing it only if contacts company is in their list of company’s?
I guess in that case I need to send there data?
