// the take
parse-hipaa is a Docker-packaged parse-server (Postgres or Mongo) with tightened defaults aimed at HIPAA/GDPR-adjacent deployments, bundled with its own dashboard fork and built-in compatibility with ParseCareKit. It's for teams building medical research or care-management apps on iOS/Android/web who want a Parse backend without inheriting parse-server's wide-open defaults.
Locks down real gaps in stock parse-server: the User class and ParseCareKit classes reject unauthenticated access, client-side class/field creation is disabled, file uploads require auth and are AES-256-GCM encrypted by default. Ships ready-to-run Docker and Singularity images for both Postgres and Mongo, with documented HA topology (multiple parse-hipaa nodes behind nginx plus a dashboard node). Adds database-level auditing (pgaudit on Postgres) on top of Parse's own logging, which is normally extra work you'd have to bolt on yourself for an audit trail.
It is not HIPAA compliant out of the box — encryption at rest, encryption in transit, and a BAA with your cloud provider are all left as manual follow-up, and the README's own disclaimer says there's no guarantee of compliance and no liability for mishandled data. The AWS CloudFormation/Elastic Beanstalk one-click path defaults to plain HTTP, stores the dashboard password as plain text, and documents raw AWS access keys as an option — rough defaults for anything claiming to target healthcare workloads. It's tightly coupled to a parse-server/parse-dashboard fork and ParseCareKit, so it's really scoped to the CareKit/ResearchKit niche rather than general BaaS use, and clamav virus scanning ships disabled with no clear path to re-enable cleanly. At 112 stars from a small single-org maintainer, you're trusting one team to keep pace with upstream parse-server security patches on infrastructure that's handling health data.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →