Is Payload CMS HIPAA Compliant? Payload Cloud, Figma, and the Self-Hosted Path (2026)
Last updated: September 14, 2026
Payload CMS is not HIPAA compliant on its own, and no CMS is. HIPAA regulates the organizations that handle patient data, not the software they build with. Payload also has no vendor cloud route to compliance today. Payload Cloud is paused for new projects, and no Payload page offers a Business Associate Agreement (BAA) as of September 14, 2026. So a Payload CMS HIPAA compliant setup means self-hosted Payload 3 on a host that signs a BAA. It also means careful access rules, encrypted PHI fields, and an audit trail. The good news is that Payload is a strong base for this work. It runs inside your Next.js app, with field-level access control built in. This guide covers what Payload gives you, what the Figma deal changed, and what you still own.
TL;DR: Quick answer
Payload Cloud has paused new project deployments. Existing projects keep running. No Payload pricing, security, terms, or Enterprise page mentions HIPAA or a BAA.
Figma bought Payload on June 17, 2025, and said Payload will stay open source. Payload's terms still name Payload CMS, Inc., a Delaware corporation.
Payload 3 includes cookie, JWT, and API key login, login lockout, and collection, global, and field access control. It documents no two-factor login.
Audit logs, SSO, and publishing workflows are Enterprise features with no public price. Field encryption is a hook pattern you write yourself.
Payload patched two Critical flaws in early 2026 and a field access bypass in August 2026. Run 3.87.0 or later.
Is Payload CMS HIPAA compliant? The three-layer answer
A Payload CMS HIPAA compliant system has three layers, and each one needs an owner. The first is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. Our HIPAA business associate agreement guide explains what it must cover. The second layer is the server and database. The host runs the physical safeguards, disk encryption, backups, and patching. The third layer is your Payload config and your team. The HIPAA Security Rule lists five technical safeguards in 45 CFR § 164.312. They are access control, audit controls, integrity, person or entity authentication, and transmission security. Payload is strongest on access control. It is thinnest on audit logs and two-factor login. You also run a risk analysis under 45 CFR § 164.308(a)(1). Payload often powers the parts of a health product that matter most: intake forms, member areas, and portals. That makes the Payload CMS HIPAA compliant question more pressing than it is for a plain marketing site.
What does Payload 3 give you for the HIPAA technical safeguards?
Here is how Payload 3 maps to each rule in 45 CFR § 164.312. The middle column is what ships in open-source Payload. The last column is what a Payload CMS HIPAA compliant app still needs from you or your host.
Safeguard (45 CFR § 164.312) | What Payload 3 provides | What you still add |
|---|---|---|
Access control, (a) | Collection, global, and field access functions; a default rule that requires a logged-in user | Rules for every PHI collection, and access checks in server code that uses the Local API |
Audit controls, (b) | Document versions and drafts; audit logs only on Enterprise | Enterprise audit logs, a custom hook-based log, or request and database logs from the host |
Integrity, (c) | Version history for documents | Encrypted, tested database backups at the host |
Person or entity authentication, (d) | HTTP-only cookie, JWT, and API key login; lockout after failed attempts; email verification | Two-factor login through SSO or a proxy, since none is documented in core |
Transmission security, (e) | A CSRF allow list and CORS settings | TLS at the host, which Payload's docs say production should always use |
One detail matters more than any other. Payload's docs say all access control is skipped by default in the Local API. That API is what server components and scripts call. So a Next.js page can read a patient record with no permission check, unless you pass overrideAccess set to false. Many teams miss this. It is the most common gap in Payload CMS HIPAA compliant reviews. The HIPAA rule it breaks is covered in our glossary entry on access control.
Encryption is the second Payload CMS HIPAA compliant gap. Payload encrypts API keys in the database with your PAYLOAD_SECRET. It has no encrypted field type for your own data. Payload's September 14, 2023 blog post shows the pattern instead. A beforeChange hook encrypts a field with AES-256-CTR and a fresh IV. An afterRead hook decrypts it. That works, but you own the code and the keys.
Does Payload Cloud sign a BAA?
No, and it is not taking new projects. Payload's cloud pricing page says new project deployments are paused. It says existing Cloud projects keep running, and that Payload plans to build something better. It also says Payload remains a self-hosted solution. We checked the cloud pricing, security, Enterprise, and terms pages. None mentions HIPAA, PHI, a BAA, or SOC 2. The terms name Payload CMS, Inc., a Delaware corporation, not Figma. So the Payload CMS HIPAA compliant route runs through a host you pick. Here are the realistic options as of September 14, 2026.
Where Payload runs | BAA status | What to know |
|---|---|---|
Payload Cloud | No BAA listed | Paused for new projects |
Vercel Pro | BAA available as a paid add-on | Covers Vercel only; the database vendor needs its own BAA |
Your own AWS or DigitalOcean | Signed by the cloud provider | You harden and patch the server, database, and Node.js |
Managed Docker hosting from us | BAA signed within 24 hours | Single-tenant AWS host; you run the Payload containers |
What did Figma's purchase change? Figma's June 17, 2025 post said Payload will remain open source. It also said nothing was changing for users in the immediate future. Payload Cloud's pause came after that. For a Payload CMS HIPAA compliant plan, the takeaway is steady. The software is healthy, with release 3.89.0 on September 10, 2026. The hosted service is not a HIPAA option. We compare Vercel and other app platforms plan by plan in HIPAA compliant app hosting. Teams weighing another headless CMS can compare the Strapi HIPAA compliant route.
Which Payload features need the Enterprise plan?
The ones auditors ask about. They decide how much a Payload CMS HIPAA compliant build costs. Payload's Enterprise page lists audit logs and version control, SSO with SAML or OAuth 2.0, and publishing workflows. It also lists a visual editor and AI features. Payload does not publish an Enterprise price. You book a demo instead. That leaves open-source teams with two choices for audit controls. Buy Enterprise, or build a log with Payload hooks and pair it with host-level logs. Either can support a Payload CMS HIPAA compliant build if it records who touched PHI and when. The same goes for two-factor login. Payload documents none in core, so SSO through an identity provider is the usual path. The rules for that are in HIPAA MFA requirements.
The 9 settings that make a Payload app HIPAA-ready
These are the first settings we check in Payload CMS HIPAA compliant reviews. Each one comes from Payload's own docs.
Upgrade to 3.87.0 or later. That covers the August 2026 MongoDB field access bypass and both Critical flaws from earlier in 2026.
Keep PAYLOAD_SECRET out of your code. It salts passwords and encrypts API keys. Changing it invalidates every existing API key.
Set a short tokenExpiration. Payload's docs show 7200 seconds as an example. Match it to your logoff policy.
Turn on lockout. Set maxLoginAttempts and lockTime. The docs show 5 attempts and a 10-minute lock as an example.
Write access rules for every PHI collection and field. Do not rely on the default rule, which only checks that someone is logged in.
Pass overrideAccess set to false in server code. The Local API skips access control otherwise.
Encrypt PHI fields with hooks. Use beforeChange and afterRead hooks, and keep the key outside the database.
Lock down the Form Builder plugin. Its form collection is publicly readable by default. Restrict it and its emails field.
Set explicit csrf and cors lists. Only your own domains should send cookies or requests to Payload.
Item 3 ties to the automatic logoff rule, explained in HIPAA automatic logoff. With all nine in place, most Payload CMS HIPAA compliant work inside the app is done.
Where do Payload apps leak PHI?
Mostly through forms, email, and server code. A Payload CMS HIPAA compliant review checks all five paths below. These are the leaks we see most in Payload CMS HIPAA compliant reviews.
Form submissions. The Form Builder plugin stores every submission in your database. Intake answers become PHI the moment they are saved. Our guide to HIPAA compliant forms covers the rules.
Form emails. The plugin can place submission data straight into email bodies. Keep PHI out of those templates.
The Local API. Server components that skip access checks can render patient data to the wrong user.
Old database adapters. Before 3.73.0, the Postgres and SQLite adapters had a Critical SQL injection flaw, rated 9.8.
The database vendor. A managed database from a different company than your host needs its own BAA. See HIPAA compliant database hosting.
Patient portals combine all five risks. The build order for a portal is in HIPAA compliant patient portal.
What does HIPAA hosting for Payload cost in 2026?
A Payload CMS HIPAA compliant budget starts with a host that signs a BAA. Payload Cloud is not an option, so compare these routes.
Route | Published starting point | Who signs the BAA | What you still own |
|---|---|---|---|
Vercel Pro with the HIPAA add-on | Pro plan plus an unpublished add-on price | Vercel, for Vercel only | A separate database vendor and its BAA, logs, and backups |
Your own cloud server | Pay per resource | Your cloud provider | All hardening, Node.js and database patching, logs, backups, and the engineer's hours |
HIPAA compliant Docker hosting from us | From $249 per month, migration included | Us, within 24 hours | Your Payload images, containers, config, and data handling |
We sell the last row, so weigh it as a disclosure. The DIY row looks cheapest until you count the weekly work. Payload ships releases often, and 2026 brought several security fixes. Someone has to test and apply them, or the Payload CMS HIPAA compliant setup drifts out of date.
If you would rather not run the server layer yourself
Payload's docs include a production Dockerfile, so Payload fits container hosting well. Our HIPAA compliant Docker hosting runs your containers on a single-tenant AWS host. We run the AWS account, the network, the host operating system, and the Docker engine. We also run CloudFront, the web application firewall, encryption, audit logging, and backups. You run your Payload images, your containers, your config, and how data is handled. Your database can run as a container on the same host. That keeps a Payload CMS HIPAA compliant stack with one host and one BAA. The BAA is signed within 24 hours, before any patient data moves. Plans start from $249 per month with migration included. We sell this, so weigh it as a disclosure.
Here is the honest inverse. If Payload only runs your public website, with no forms or member areas that collect health details, it holds no PHI. Then Vercel or any good host is fine, and you do not need us. If your team already runs a cloud server under a signed BAA with an engineer who patches weekly, that works too. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what your forms collect and get a straight answer.
Frequently asked questions
Is Payload CMS HIPAA compliant?
No CMS is HIPAA compliant by itself. A Payload CMS HIPAA compliant system needs self-hosted Payload 3 on a host that signs a BAA. It also needs access rules on every PHI field, encrypted PHI fields, lockout, and an audit trail. Payload Cloud lists no BAA and is paused for new projects.
Does Payload sign a BAA?
Not publicly. Payload's cloud pricing, security, Enterprise, and terms pages mention no HIPAA or BAA, as of September 14, 2026. Without a signed BAA, Payload Cloud cannot store or process PHI. Your host signs the BAA when you self-host.
Is Payload Cloud still available?
Only for existing customers. Payload's cloud pricing page says new project deployments are paused, existing projects keep running, and a replacement is planned. Payload says it remains a self-hosted solution that runs anywhere Next.js runs.
How do I encrypt fields in Payload CMS?
Use hooks. Payload's 2023 blog post encrypts a field in a beforeChange hook with AES-256-CTR and a unique IV. It decrypts the field in an afterRead hook. Keep the key outside the database, and remember encrypted fields cannot be searched as plain text.
Can I build a patient portal with Payload?
Yes, if you plan for it. Payload gives you login, lockout, and field-level access rules inside Next.js. You add two-factor login, field encryption, audit logs, and Local API access checks. The portal must run on a host that signs a BAA.
Recap: Payload CMS HIPAA compliant
To recap, a Payload CMS HIPAA compliant setup is self-hosted Payload 3 on a host that signs a BAA. Payload Cloud is paused for new projects and lists no BAA. Figma owns Payload now, and Payload stays open source. Payload gives you cookie and JWT login, lockout, and deep access control. You add two-factor login, hook-based field encryption, an audit trail, and access checks in the Local API. Lock down Form Builder, keep PHI out of emails, and run 3.87.0 or later.
This article is general information, not legal advice. Plans, prices, BAA terms, and product status change often. The details here reflect Payload's and Figma's public pages, Payload's docs, and GitHub advisories as read on September 14, 2026. Vercel details come from our September 11, 2026 review. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed September 2026.
Sources
Payload: Cloud pricing and status, Enterprise, Security, and Terms of service.
Figma: Payload joins Figma (June 17, 2025).
Payload docs: Authentication, API keys, Access control, Configuration.
Payload docs: Form Builder plugin, Installation, Deployment.
Payload blog: Encryption with Payload hooks (September 14, 2023).
GitHub: Payload releases.
GitHub advisories: Field-level write access bypass on MongoDB, CVE-2026-34751, and CVE-2026-25544.
45 CFR § 164.312 (technical safeguards): law.cornell.edu.
45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.
45 CFR § 160.103 (definitions): ecfr.gov.