The Hidden Challenges of Using No-Code Platforms for Healthcare Applications

Building a HIPAA-compliant healthcare app is no small feat, and choosing the right tools is critical. Recently, I embarked on developing a telehealth MVP using a popular no-code platform, believing it would streamline my journey. However, after months of development, I uncovered some surprising limitations that could have been avoided with a bit more research.

Initially, I was excited by the platform’s features: AI-generated code, integrated authentication with Clerk, a robust database via Supabase, and even a security scan feature. Everything seemed aligned with my goal to create a HIPAA-ready solution. Yet, upon closer inspection of their terms, I discovered that the service lacked any Business Associate Agreement (BAA)—a fundamental requirement for handling protected health information (PHI). This omission was openly stated, with no hidden clauses or paywalls.

Moreover, unless you’re on an enterprise plan, the platform explicitly reserves the right to use your prompts and data to train their AI models. This raised concerns about patient confidentiality, especially since the “test” scenarios I had been running could inadvertently feed sensitive patient data into their training pipelines.

While it is technically possible to configure the Clerk and Supabase setup to meet HIPAA standards, doing so requires extensive manual effort—signing multiple BAAs, managing custom configurations, and essentially becoming a compliance expert overnight. Unfortunately, the platform itself remains outside the security perimeter, meaning it does not inherently guarantee data protection for PHI.

Faced with these realities, I had no choice but to rebuild my application using dedicated healthcare infrastructure designed with compliance in mind. Surprisingly, approaching compliance properly from the start allowed me to ship faster and with greater confidence, instead of patching together solutions that weren’t built for healthcare.

Looking back, I wish I had known upfront that while this no-code platform is fantastic for rapid prototyping, it falls short for handling sensitive health data. That insight might have saved me considerable time and frustration.

Has anyone else encountered similar challenges with no-code or low-code tools in healthcare development? Sharing experiences can help prevent others from making the same mistakes.