Skip to main content
The Health Insurance Portability and Accountability Act (HIPAA) is the U.S. federal law enacted to protect patient health information. The law sets stringent standards to secure electronic protected health information (ePHI/PHI). HIPAA compliance is a self-serve add-on for Pay-as-you-go accounts. You enable it yourself from the dashboard and sign the Business Associate Agreement (BAA) there. No sales conversation or contract is required. This page explains how to enable it and contains ngrok’s recommendations for setting up ngrok services in a HIPAA-compliant manner.
These recommendations from ngrok’s team do not constitute legal advice. Please consult your own legal and engineering teams to ensure HIPAA compliance.

​
Get started

You can enable HIPAA compliance yourself from the ngrok dashboard by navigating to Billing, then adding the HIPAA compliance add-on and signing the BAA. Before you enable HIPAA, make sure your account meets these requirements:
  1. You must be an admin.
  2. You must have a v3 pay-as-you-go account.
  3. You must execute a Business Associate Agreement (BAA) by providing the executor name and legal business name. You can view the executed BAA on the billing page at any time after you agree to it.
While HIPAA compliance is enabled, you can’t downgrade your account plan.

​
What changes when HIPAA compliance is enabled

Enabling HIPAA compliance applies the following changes to your account to help keep PHI (protected health information) out of stored data:
  • Price: usage-based charges are billed at +50%. The base plan fee and per-seat charges are not affected.
  • HTTPS-only endpoints: HTTP endpoints are disabled (ERR_NGROK_6031, ERR_NGROK_9043).
  • Traffic Inspector: full capture is limited to metadata. Request data, such as headers and bodies, is hidden.
  • SSH tunneling: disabled (ERR_NGROK_1125).
  • Agent transport: the ngrok agent is forced to connect over TLS.
  • Event Subscriptions: disabled.

​
Shared responsibility model

ngrok operates with a shared responsibility model. There are many safeguards that ngrok puts in place to protect customers, and there are steps customers must take to remain compliant with HIPAA. ngrok is responsible for providing you, the customer, with all the information you need to use ngrok in a compliant manner, and how to configure the ngrok platform to remain compliant. You are responsible for ensuring your use case is compliant and configuring ngrok correctly to ensure compliance.

​
Compliant use cases

ngrok is HIPAA-compliant for use cases where PHI is stored within a packet payload. You are responsible for ensuring that PHI is only present within the packet payload. ngrok won’t store this data in HIPAA workloads but does store other, non-PHI, data. See Data at ngrok for more details on what data ngrok stores. ngrok account user information, ngrok account billing information, and packet headers should not be considered PHI within any use cases.

​
Customer safeguards

These are ngrok’s recommendations for setting up and configuring your ngrok account securely:
  • Ensure packet payloads are the only PHI data being sent over the ngrok network
    • Don’t put PHI in JWT tokens
    • Don’t put PHI in packet headers
    • Don’t put PHI in URL parameters
  • Ensure the ngrok agent is on a secure machine. The agent-local inspector may have ePHI.
  • Ensure that any traffic forwarded from the ngrok agent through your network is secure.
  • Use managed certificates. ngrok will automatically provision and renew TLS certificates on your behalf.
  • Verify webhooks to ensure the authenticity of incoming requests
See the guide on security quick wins for information on how to set up authentication, authorization, encryption, auth tokens, logging, and related features in a secure manner.