Would love to get a response to this. We are required to be HIPAA compliant and started out on Heroku. We basically only had a prototype built and didn&#x27;t have any clients yet, so we didn&#x27;t really care. After a weeks of paying for Heroku we got a very standard sales call from Heroku. They were checking-in&#x2F;trying to up-sell us on some stuff.<p>They asked us what we needed, and I responded with, &quot;We need to be HIPAA compliant - what do we need to do to make that happen on Heroku?&quot;<p>The sales rep immediately replied along the lines, &quot;We don&#x27;t do that.&quot;<p>He ended the call shortly after that, clearly uninterested in our money.<p>Since then, we started using Aptible (<a href="https:&#x2F;&#x2F;www.aptible.com)and" rel="nofollow">https:&#x2F;&#x2F;www.aptible.com)and</a> they are AWESOME. The biggest difference for us is that they also provide the legal documentation and advice to working through HIPAA compliance. They&#x27;re totally willing to go beyond just being a PaaS and really start to blend into a moderate level of legal counsel. Only downside is that their premium service entails a premium price.