Amplitude for healthcare · every vendor claim below is Amplitude's own, source-linked
Amplitude in healthcare: the architecture matters more than the checkbox
Product analytics in a covered entity is an architecture problem wearing a compliance costume: what enters the event stream, who can see it, how it leaves, and what can be deleted on demand. Here is what Amplitude actually provides - in its own words - and the work that remains yours.
Why does healthcare product analytics go wrong?
Not usually at the contract stage - at the instrumentation stage. PHI doesn't arrive in a column marked PHI; it arrives as an event name someone typed ('patient record viewed' with an identifier in a property), a URL path carrying an appointment ID, a replay capturing a form nobody masked, or a user_id that is itself an identifier. Every one of those is an instrumentation decision, made by whoever shipped the event, usually under deadline.
That is why our position - judgment, from enterprise analytics practice - is that regulated analytics is won in the tracking plan and the identity design, not in the vendor's trust portal. The vendor's controls matter; the discipline that keeps PHI out of the stream in the first place matters more.
What does Amplitude actually offer a covered entity?
In Amplitude's own published words (sources below) - phrased here exactly as carefully as they phrase it:
| Capability | Amplitude’s published position |
|---|---|
| BAA | Amplitude states it 'can enter a Business Associates Agreement to help you maintain your HIPAA compliance' - and that its AI features are covered under its BAAs, with corresponding BAAs with its third-party AI subprocessors. Terms and plan requirements are contract-dependent: confirm with Amplitude directly. |
| Data deletion | The User Privacy API deletes all data for specified users across 'all of Amplitude's systems, including associated recovery and back-up systems,' processed within 30 days per GDPR articles 12.3 and 17. A DSAR API serves access requests. |
| Session replay masking | A documented 'Conservative' privacy level masks all text and all form fields - and Amplitude's own docs name healthcare and medical technology companies as its example users. |
| Access controls | Data Access Controls (restricting who can see 'sensitive categories of event and property data') and advanced RBAC sit on the Enterprise tier per amplitude.com/pricing; Data Access Controls additionally require Amplitude Support enablement. |
| Attestations | SOC 2 Type II and SOC 1 Type II via Amplitude's Trust Center (trust.amplitude.com); self-certified under the EU-US Data Privacy Framework; EU data residency available (Frankfurt), chosen at organization signup. |
What you will NOT find on Amplitude's public pages, so it does not appear here: 'HIPAA certified' (no such certification exists for anyone), plan tiers for the BAA, or PCI DSS. Anyone stating those as fact is ahead of the vendor's own claims.
What we build on top - the covered entity's half of the work
| Deliverable | What it covers |
|---|---|
| PHI-out-by-design tracking plan | Event and property vocabulary designed so protected information structurally can't enter the stream: no free-text properties on clinical surfaces, identifiers hashed or excluded, URL-capture rules for paths that embed record IDs. |
| Identity architecture | A user_id that is internal and non-identifying, deliberate logout/reset behavior on shared clinical devices, and merge design that supports deletion requests cleanly. |
| Consent-gated capture | Consent Mode-style gating for analytics and replay - Amplitude's own replay guidance says not to enable capture before consent where law requires it. Replay ships at Conservative masking until counsel approves anything lighter. |
| Governance with teeth | Naming rules enforced at the pipeline edge (our taxonomy linter catches PII-shaped names mechanically), quarterly audits of new events, and a documented deletion-request runbook wired to the User Privacy API. |
Deliberately absent: outcome claims. We publish no healthcare case studies until a client approves one. Your counsel owns the compliance determination; we build the architecture that makes their job tractable.
Related: the implementation sprint this work rides in, the taxonomy linter that catches PII-shaped event names mechanically, and the identity resolution guide underneath the deletion story.
Sources
- Amplitude: Security & Privacy (BAA wording, DPF, EU residency, no-PII stance)
- Amplitude: Healthcare industry page (BAA wording in healthcare context)
- Amplitude docs: User Privacy API (30-day deletion)
- Amplitude docs: DSAR API
- Amplitude docs: Session Replay privacy (Conservative level; healthcare named)
- Amplitude docs: Data Access Controls (support enablement)
- Amplitude Trust Center (SOC 2 Type II / SOC 1 Type II)
- Amplitude pricing (Enterprise: Data Access Controls, advanced RBAC)
Frequently asked questions
Is Amplitude HIPAA compliant?+
That's not a question a vendor can answer alone - HIPAA compliance is a property of your program, not a product badge. What Amplitude publicly states: it can enter a Business Associates Agreement, its AI features are covered under its BAAs, and it provides deletion APIs, conservative replay masking, and Enterprise-tier access controls. Whether your implementation is compliant depends on what your instrumentation sends and who can see it - which is the half we build.
Can we use Session Replay in a healthcare product?+
Amplitude's docs describe the Conservative masking level - all text and all form fields masked - and explicitly name healthcare and medical technology companies as its users. The workable pattern: consent-gated capture, Conservative masking as the default, and counsel sign-off before any unmasking. Replay of clinical workflows deserves its own review.
What should never be sent to Amplitude in a healthcare context?+
Amplitude's own stance is that it needs no PII to function. Practically: no names, contact details, or record identifiers in event names or properties; no free-text fields from clinical surfaces; hashed internal IDs as user_id; and URL capture configured so paths carrying appointment or record IDs never become properties. The tracking plan enforces this structurally - that's its job.
Start with the audit - regulated instances especially
The free scored audit reads your instance across ten dimensions, including the ones regulators care about: identity behavior, PII exposure in names and properties, access patterns, and warehouse agreement. Read-only access, 48-hour turnaround, NDA on request.
Request the free audit